Oracle ADI Plain Text Password Storage Vulnerability

Bugtraq ID:	2694
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	May 07 2001 12:00AM
Updated:	May 07 2001 12:00AM
Credit:	This vulnerability was announced to Bugtraq by Melanie Abbas <[email protected]> on May 7, 2001.
Vulnerable:	Oracle Application Desktop Integrator 7.1.1 .10.1 - Microsoft Windows 2000 Professional - Microsoft Windows 98SE - Microsoft Windows NT 4.0
Not Vulnerable:

Oracle ADI Plain Text Password Storage Vulnerability

Oracle Application Desktop Integrator (ADI) is part of the Oracle Financial Applications. ADI is a software package designed to allow desktop users to manipulate the database from a personal computer.

A problem in this software package could allow access to plain text passwords. The ADI package queries the database for the encrypted password, and decrypts it at the local system, thus allowing the ADI user to log into the database. However, this password is stored in a plain text file.

This makes it possible for a local user to gain access to the APPS Schema password, and potentially full access to the database.

Oracle ADI Plain Text Password Storage Vulnerability

See discussion.

Oracle ADI Plain Text Password Storage Vulnerability

Solution:
Oracle has released a patch which addresses this issue.

http://metalink.oracle.com

Oracle ADI Plain Text Password Storage Vulnerability

References: