Oracle Applications 11i Unspecified Encrypted Password Information Disclosure Vulnerability
BID:23446
Info
Oracle Applications 11i Unspecified Encrypted Password Information Disclosure Vulnerability
| Bugtraq ID: | 23446 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 12 2007 12:00AM |
| Updated: | Apr 12 2007 07:31PM |
| Credit: | Integrigy is credited with the discovery of this vulnerability. |
| Vulnerable: |
Oracle Applications 11i 11.5.10 CU2 Oracle Applications 11i 11.5.10 CU1 Oracle Applications 11i 11.5.10 Oracle Applications 11i 11.5.9 Oracle Applications 11i 11.5.8 Oracle Applications 11i 11.5.7 Oracle Applications 11i 11.5.6 Oracle Applications 11i 11.5.5 Oracle Applications 11i 11.5.4 Oracle Applications 11i 11.5.3 Oracle Applications 11i 11.5.1 Oracle Applications 11i 11.5 |
| Not Vulnerable: | |
Discussion
Oracle Applications 11i Unspecified Encrypted Password Information Disclosure Vulnerability
Oracle Applications 11i is prone to an information-disclosure vulnerability because the software fails to protect sensitive information.
To exploit this issue, an attacker must have SQL*Net access to the database.
The attacker can exploit this issue to obtain the encrypted password string to another user's account or to the Oracle Application's main database account.
Applications using Oracle Applications security features such as "Managed SQL*Net Access" and "Server Security" are not vulnerable to this issue.
Oracle Applications 11i is prone to an information-disclosure vulnerability because the software fails to protect sensitive information.
To exploit this issue, an attacker must have SQL*Net access to the database.
The attacker can exploit this issue to obtain the encrypted password string to another user's account or to the Oracle Application's main database account.
Applications using Oracle Applications security features such as "Managed SQL*Net Access" and "Server Security" are not vulnerable to this issue.
Exploit / POC
Oracle Applications 11i Unspecified Encrypted Password Information Disclosure Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution / Fix
Oracle Applications 11i Unspecified Encrypted Password Information Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
References
Oracle Applications 11i Unspecified Encrypted Password Information Disclosure Vulnerability
References:
References:
- Oracle Homepage (Oracle)
- Oracle Applications 11i Encrypted Password String Disclosure (Integrigy)