Oracle E-Business Suite administrators who have applied CPU patches for July 2012, October 2012, January 2013, or April 2013 and use the native login pages are affected by a credential exposure vulnerability (CWE-200). Credentials are exposed to the FND_LOG_MESSAGES database table or a log file. The credentials in the logs will be viewable by an attacker wilth privileged database or privileged operating system access.

An authenticated attacker with privileged access may be able to read Oracle E-Business Suite credentials from the database logs.

Apply an Update

Oracle E-Business Suite administrators are advised to apply Oracle CPU July 2013 to address this vulnerability. Please see My Oracle Support (MOS) Note 1579709.1 for additional details and mitigation steps.

Purge credentials from the database logs

Oracle E-Business Suite administrators that are affected by this vulnerability should purge the database logs of any credentials that were exposed. My Oracle Support (MOS) Note 1579709.1 states the following mitigation steps:

MITIGATION STEP Prevent Logging of Passwords
For customers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013, and have not yet applied the JUL 2013 CPU, the following trigger will prevent any additional logging of passwords within FND_LOG_MESSAGES.

In SQL*Plus, login as APPS, and do the following:

CREATE OR REPLACE TRIGGER
FND_LOG_MESSAGES_BI
BEFORE INSERT ON APPLSYS.FND_LOG_MESSAGES
REFERENCING NEW AS NEW OLD AS OLD FOR EACH ROW
WHEN (NEW.module like 'fnd.sso.SecureHttpRequest%')
BEGIN
:NEW.message_text := 'Ignored';
END;
/

Once the JUL 2013 CPU has been applied, the trigger is no longer required and should be dropped for performance reasons.

In SQL*Plus, login as APPS, and do the following:

DROP TRIGGER
FND_LOG_MESSAGES_BI;

MITIGATION STEP Cleanup Old Log Entries
Customers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013 will have log entries that need to be purged. For log entries in the database, remove entries in FND_LOG_MESSAGES by either truncating the table or by selectively deleting the problematic rows.

Customers that have applied one of the patches with the vulnerability listed above will likely have log entries that need to be purged. By default, E-Business Suite logs to FND_LOG_MESSAGES. Customers can optionally configure the system to log to a file on the applications tier by setting the AFLOG_FILENAME profile (this parameter can also be set as a java system property or environment variable). See Oracle E-Business Suite System Administrator's Guide - Configuration: Logging for more information on logging configuration.

For log entries in the database, remove entries in FND_LOG_MESSAGES by either truncating the table or by selectively deleting the problematic rows.

In SQL*Plus, login as APPS, and do one of the following:
 
TRUNCATE TABLE FND_LOG_MESSAGES;
 
or
 
DELETE FND_LOG_MESSAGES
  where MODULE  like 'fnd.sso.SecureHttpRequest%.secureParse';
COMMIT;
 
 
For log files in the file system purge the log files, or you can run the following commands to remove the specific problematic entries:

For a single file
 
sed -i  -e '/fnd.sso.SecureHttpRequest/d' file_name
 
or for multiple files
 
find /some/dir  -name '*.log' -exec  \
sed -i -e '/fnd.sso.SecureHttpRequest/d' {} \;

MITIGATION STEP Force a password change for all E-Business Suite accounts (optional)
If you suspect that logs with passwords have been compromised via the production instance, cloned database copies, or database backups, you should force a password change for all E-Business Suite accounts. For passwords that are managed through OID, passwords should be expired via OID. For passwords managed by E-Business Suite you can force a password change by performing the following steps:

1. Login to database as the APPS user, and run the following SQL:

UPDATE FND_USER set PASSWORD_DATE = NULL
  where nvl(END_DATE, sysdate+1) > sysdate
    and USER_NAME not in ('GUEST','AUTOINSTALL','ASADMIN',
        'ORACLE12.0.0','ORACLE12.1.0','ORACLE12.2.0','ORACLE12.3.0',
        'ORACLE12.4.0','ORACLE12.5.0','ORACLE12.6.0','ORACLE12.7.0',
        'ORACLE12.8.0','ORACLE12.9.0');
COMMIT;

2. Login to E-Business Suite as the SYSADMIN user. You will be prompted to change the SYSADMIN password. Change the SYSADMIN password.
3. To change the GUEST password, follow MOS note: 443353.1 - How To Successfully Change The Guest Password In E-Business Suite 11.5.10 and R12
4. To change the ASASMIN password, follow MOS note: 556540.1 - Installing Oracle E-Business Suite Integrated SOA Gateway, Release 12 - Section: 3.3, Steps: (8 - 11)

For any additional clarification please contact Oracle Support.