Oracle HTTP Server MOD_ORADAV ORAALTPASSWORD Obfuscation Weakness

Bugtraq ID:	14277
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 15 2005 12:00AM
Updated:	Jul 15 2005 12:00AM
Credit:	This issue was announced by Oracle.
Vulnerable:	Oracle Oracle HTTP Server 9.0.2 .3 + Oracle Oracle9i Application Server 9.0.2 .3
Not Vulnerable:

Oracle HTTP Server MOD_ORADAV ORAALTPASSWORD Obfuscation Weakness

A security weakness exists in the Oracle HTTP Server mod_oradav module. The issue is that the ORAALTPASSWORD is obfuscated when it should be encrypted. A malicious user with access to the obfuscated password could easily decode it as a result.

This issue was mentioned in the patch readme for the Oracle Critical Patch Update for July. Oracle has not released any further information about this weakness.

Oracle HTTP Server MOD_ORADAV ORAALTPASSWORD Obfuscation Weakness

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Oracle HTTP Server MOD_ORADAV ORAALTPASSWORD Obfuscation Weakness

Solution:
This issue is addressed in the Oracle Critical Patch Update - July 2005.

Pre-installation notes for Oracle Database Server can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=311062.1

Pre-installation notes for Oracle Application Server can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=311038.1

Oracle HTTP Server MOD_ORADAV ORAALTPASSWORD Obfuscation Weakness

References:

• Critical Patch Update - July 2005 (Oracle)
  
• Oracle CPU July 2005 - Silently fixed bugs (Red Database Security)