Plaintext Password Vulnerabilitiy during Installation of Oracle HTMLDB
Plaintext Password Vulnerabilitiy during Installation of Oracle HTMLDB
#######################################################################
Name Cross-Site-Scripting Vulnerabilities in Oracle XMLDB
Systems Affected Oracle HTMLDB
Severity Low Risk
Category Plaintext Password of SYS is logged during Installation of
HTMLDB
Vendor URL http://www.oracle.com
This advisory
http://www.red-database-security.com/advisory/oracle_htmldb_plaintext_password.html
Author Alexander Kornbrust (ak at red-database-security.com)
Date 7 October 2005 (V 1.00)
Details
#######
Oracle HTML DB is a rapid web application development tool for the Oracle
database. Using only a web browser and limited programming experience, it is
possible to develop and deploy professional-looking applications that are both
fast and secure.
During the manuell installation of HTMLDB the SYS password is logged in
plaintext
into the file install.lst. The SYS password should never be stored in a text
file
in clear text.
Affected Products
#################
Oracle HTMLDB
Testcase
########
Extract from install.lst:
>> Is this a (1) New install or an (2) Upgrade? [1]
>> What is your connect string (Enter for none)? [] ora902
>> What is your Oracle SYS password? [CHANGE_ON_INSTALL] mysecretpassword1
Patch Information
#################
This bug is fixed with Critical Patch Update April 2005 (CPU April 2005).
Oracle forgot
to inform Red-Database-Security that this bug is fixed with CPU April 2005.
Oracle also forgot to mention Red-Database-Security in the credits of CPU April
2005.
All already published alerts are available on the web site of
Red-Database-Security GmbH
http://www.red-database-security.com/advisory/published_alerts.html
Workaround
##########
Delete the file install.lst manually.
History
#######
26-jan-2004 Oracle secalert was informed
27-jan-2004 Bug confirmed
13-apr-2005 Oracle published CPU April 2005 without informing
Red-Database-Security
that this bug is already fixed.
07-oct-2005 Red-Database-Security published this advisory
© 2005 by Red-Database-Security GmbH - last update 7-october-2005