Unprivileged DB users can see APEX password hashes
Name Unprivileged DB users can see APEX password hashes
Systems Affected APEX 3.0 (optional component of 11.1.0.7 installation)
Severity High Risk
Category Password Disclosure
Vendor URL http://www.oracle.com/
Author Alexander Kornbrust (ak at red-database-security.com)
CVE CVE-2009-0981
Advisory 14 April 2009 (V 1.00)
Details:
Unprivileged database users can see APEX password hashes in
FLOWS_030000.WWV_FLOW_USER.
SQL> select user_name,web_password2 from FLOWS_030000.WWV_FLOW_USERS
USER_NAME WEB_PASSWORD2
----------------------------------------------------------------------
YURI 141FA790354FB6C72802FDEA86353F31
This password hash can be checked using a tool like Repscan.
Additional information is available in the following advisory.
Advisory:
http://www.red-database-security.com/advisory/apex_password_hashes.html
Patch Information:
Upgrade to Oracle APEX 3.2.
Verification:
Our Oracle database scanner Repscan was updated with the information from the
Oracle
CPU April 2009 and can identify vulnerable databases.
More Information about Repscan can be found here:
http://www.sentrigo.com/repscan
History:
13-jan-2009 Oracle published CPU April 2009 [CVE-2009-0981]
14-apr-2009 Oracle published CPU April 2009 [CVE-2009-0981]
14-apr-2009 Advisory published
About Red-Database-Security:
Red-Database-Security is the leading company for Oracle security. Within the
last
6 years we reported several hundred vulnerabilities to Oracle.
--
(c) 2009 by Red-Database-Security GmbH
http://www.red-database-security.com