PT-2004-2284 · Oracle · Oracle 10G Database Server

David Litchfield · Published 2004-08-04 · Updated 2016-10-18 · CVE-2004-1367

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Oracle 10g Database Server (affected versions not specified)

Description: The issue arises when the Oracle 10g Database Server is installed with a password containing an exclamation point for the DBSNMP or SYSMAN user. This results in an error that logs the password in the world-readable postDBCreation.log file. Local users could potentially obtain the password and use it to access SYS or SYSTEM accounts if they were installed with the same password.

Recommendations: For Oracle 10g Database Server, consider changing the passwords for the DBSNMP and SYSMAN users to not include an exclamation point, and restrict access to the postDBCreation.log file to prevent unauthorized users from obtaining the password. Additionally, ensure that the SYS and SYSTEM accounts do not use the same password as the DBSNMP or SYSMAN users to minimize potential damage.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2004-1367

Affected Products

Oracle 10G Database Server

References · 8

• http://ngssoftware.com/advisories/oracle23122004D.txt · Vendor Advisory
• http://oracle.com/technology/deploy/security/pdf/2004alert68.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1367 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1367 · Note
• http://marc.info/?l=bugtraq&m=110382247308064&w=2 · Note
• http://us-cert.gov/cas/techalerts/TA04-245A.html · Note
• http://kb.cert.org/vuls/id/316206 · Note