Software Engineering Institute

Oracle E-Business Suite administrators who have applied CPU patches for July 2012, October 2012, January 2013, or April 2013 and use the native login pages are affected by a credential exposure vulnerability (CWE-200). Credentials are exposed to the FND_LOG_MESSAGES database table or a log file. The credentials in the logs will be viewable by an attacker wilth privileged database or privileged operating system access.

An authenticated attacker with privileged access may be able to read Oracle E-Business Suite credentials from the database logs.

Apply an Update

Oracle E-Business Suite administrators are advised to apply Oracle CPU July 2013 to address this vulnerability. Please see My Oracle Support (MOS) Note 1579709.1 for additional details and mitigation steps.

Purge credentials from the database logs

Oracle E-Business Suite administrators that are affected by this vulnerability should purge the database logs of any credentials that were exposed. My Oracle Support (MOS) Note 1579709.1 states the following mitigation steps:

MITIGATION STEP Prevent Logging of Passwords
For customers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013, and have not yet applied the JUL 2013 CPU, the following trigger will prevent any additional logging of passwords within FND_LOG_MESSAGES.

In SQL*Plus, login as APPS, and do the following:

CREATE OR REPLACE TRIGGER
FND_LOG_MESSAGES_BI
BEFORE INSERT ON APPLSYS.FND_LOG_MESSAGES
REFERENCING NEW AS NEW OLD AS OLD FOR EACH ROW
WHEN (NEW.module like 'fnd.sso.SecureHttpRequest%')
BEGIN
:NEW.message_text := 'Ignored';
END;
/

DROP TRIGGER
FND_LOG_MESSAGES_BI;

 
TRUNCATE TABLE FND_LOG_MESSAGES;
 
or
 
DELETE FND_LOG_MESSAGES
  where MODULE  like 'fnd.sso.SecureHttpRequest%.secureParse';
COMMIT;

sed -i  -e '/fnd.sso.SecureHttpRequest/d' file_name

find /some/dir  -name '*.log' -exec  \
sed -i -e '/fnd.sso.SecureHttpRequest/d' {} \;

UPDATE FND_USER set PASSWORD_DATE = NULL
  where nvl(END_DATE, sysdate+1) > sysdate
    and USER_NAME not in ('GUEST','AUTOINSTALL','ASADMIN',
        'ORACLE12.0.0','ORACLE12.1.0','ORACLE12.2.0','ORACLE12.3.0',
        'ORACLE12.4.0','ORACLE12.5.0','ORACLE12.6.0','ORACLE12.7.0',
        'ORACLE12.8.0','ORACLE12.9.0');
COMMIT;