Description
Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges.
References
- oracle-sysman-password-plaintext(18661) vdb-entry
- 20041223 Oracle clear text passwords (#NISR2122004D) mailing-list
- VU#316206 third-party-advisory
- TA04-245A third-party-advisory
- http://www.ngssoftware.com/advisories/oracle23122004D.txt
- 10871 vdb-entry
- http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf
- 101782 vendor-advisory