PT-1999-1629 · Oracle · Oracle Database Assistant+1

Published 1999-03-04 · Updated 2017-12-19 · CVE-1999-1256

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Oracle Database Assistant version 1.0 in Oracle 8.0.3 Enterprise Edition

Description: The issue allows local users to obtain the database master password from the spoolmain.log file when a new database is created, as the password is stored in plaintext in this file.

Recommendations: For Oracle Database Assistant 1.0 in Oracle 8.0.3 Enterprise Edition, consider restricting access to the spoolmain.log file to minimize the risk of password exposure until a fix is available.

Exploit

Fix

Related Identifiers

CVE-1999-1256

Affected Products

Oracle 8.0.3 Enterprise Edition

Oracle Database Assistant

References · 4

• 🔥 http://securityfocus.com/archive/1/12744 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-1999-1256 · Security Note
• http://marc.info/?l=ntbugtraq&m=92056752115116&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/1902 · Note