JVNVU#93138008
Oracle E-Business Suite にパスワード漏えいの脆弱性

Oracle E-Business Suite には、パスワード漏えいの脆弱性が存在します。

Oracle Critical Patch Update Advisory - July 2013 には、サポートされているバージョンのうち Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3 が本脆弱性の影響を受けると記載されています。

Oracle E-Business Suite には、標準のログイン画面を使用している場合に、パスワード漏えいの脆弱性 (CWE-200) が存在します。

当該製品のデータベースへのアクセス権限を持つユーザによって、他のユーザのパスワードを閲覧される可能性があります。

アップデートする
本脆弱性は Oracle CPU July 2013 で修正されています。
詳しくは、My Oracle Support (MOS) Note 1579709.1 をご確認ください。

データベースのログにパスワードを記録しない
My Oracle Support (MOS) Note 1579709.1 には、Oracle CPU July 2013 のパッチを適用していないユーザ向けに、次のようなワークアラウンドが記載されています。

MITIGATION STEP Prevent Logging of Passwords
For customers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013, and have not yet applied the JUL 2013 CPU, the following trigger will prevent any additional logging of passwords within FND_LOG_MESSAGES.

In SQL*Plus, login as APPS, and do the following:

CREATE OR REPLACE TRIGGER
FND_LOG_MESSAGES_BI
BEFORE INSERT ON APPLSYS.FND_LOG_MESSAGES
REFERENCING NEW AS NEW OLD AS OLD FOR EACH ROW
WHEN (NEW.module like 'fnd.sso.SecureHttpRequest%')
BEGIN
:NEW.message_text := 'Ignored';
END;
/

Once the JUL 2013 CPU has been applied, the trigger is no longer required and should be dropped for performance reasons.

In SQL*Plus, login as APPS, and do the following:

DROP TRIGGER
FND_LOG_MESSAGES_BI;

MITIGATION STEP Cleanup Old Log Entries
Customers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013 will have log entries that need to be purged. For log entries in the database, remove entries in FND_LOG_MESSAGES by either truncating the table or by selectively deleting the problematic rows.

Customers that have applied one of the patches with the vulnerability listed above will likely have log entries that need to be purged. By default, E-Business Suite logs to FND_LOG_MESSAGES. Customers can optionally configure the system to log to a file on the applications tier by setting the AFLOG_FILENAME profile (this parameter can also be set as a java system property or environment variable). See Oracle E-Business Suite System Administrator's Guide - Configuration: Logging for more information on logging configuration.

For log entries in the database, remove entries in FND_LOG_MESSAGES by either truncating the table or by selectively deleting the problematic rows.

In SQL*Plus, login as APPS, and do one of the following:
 
TRUNCATE TABLE FND_LOG_MESSAGES;
 
or
 
DELETE FND_LOG_MESSAGES
  where MODULE  like 'fnd.sso.SecureHttpRequest%.secureParse';
COMMIT;
 
 
For log files in the file system purge the log files, or you can run the following commands to remove the specific problematic entries:

For a single file
 
sed -i  -e '/fnd.sso.SecureHttpRequest/d' file_name
 
or for multiple files
 
find /some/dir  -name '*.log' -exec  \
sed -i -e '/fnd.sso.SecureHttpRequest/d' {} \;

MITIGATION STEP Force a password change for all E-Business Suite accounts (optional)
If you suspect that logs with passwords have been compromised via the production instance, cloned database copies, or database backups, you should force a password change for all E-Business Suite accounts. For passwords that are managed through OID, passwords should be expired via OID. For passwords managed by E-Business Suite you can force a password change by performing the following steps:

1. Login to database as the APPS user, and run the following SQL:

UPDATE FND_USER set PASSWORD_DATE = NULL
  where nvl(END_DATE, sysdate+1) > sysdate
    and USER_NAME not in ('GUEST','AUTOINSTALL','ASADMIN',
        'ORACLE12.0.0','ORACLE12.1.0','ORACLE12.2.0','ORACLE12.3.0',
        'ORACLE12.4.0','ORACLE12.5.0','ORACLE12.6.0','ORACLE12.7.0',
        'ORACLE12.8.0','ORACLE12.9.0');
COMMIT;

2. Login to E-Business Suite as the SYSADMIN user. You will be prompted to change the SYSADMIN password. Change the SYSADMIN password.
3. To change the GUEST password, follow MOS note: 443353.1 - How To Successfully Change The Guest Password In E-Business Suite 11.5.10 and R12
4. To change the ASASMIN password, follow MOS note: 556540.1 - Installing Oracle E-Business Suite Integrated SOA Gateway, Release 12 - Section: 3.3, Steps: (8 - 11)

For any additional clarification please contact Oracle Support.