CVE:CVE-2004-1366
CNNVD:CNNVD-200408-005
Oracle Database是一款商业性质大型数据库系统。
Oracle 10g存在包含明文密码的全局可读文件，本地攻击者可以利用这个漏洞获得对数据库的访问。
SYSMAN帐户的密码可在'$ORACLE_HOME/hostname_sid/sysman/config/emoms.properties'文件中获得，此文件全局可读。
另外如果安装Oracle 10g时提供SYS， SYSTEM， DBSNMP和SYSMAN 帐户密码相同，并且密码有惊叹号(如f00bar!!)，那么当设置SYSMAN和DBSNMP密码时DB安装会出现错误，错误信息"postDBCreation.log"会记录密码：
alter user SYSMAN identified by f00bar!! account unlock
ERROR at line 1:
ORA-00922: missing or invalid option
alter user DBSNMP identified by f00bar!! account unlock
ERROR at line 1:
ORA-00922: missing or invalid option
solution:Upgrade oracle application_server to a higher version than *,9.0.2,9.0.2.0.0,9.0.2.0.1,9.0.2.1,9.0.2.2,9.0.2.3,9.0.3,9.0.3.1,9.0.4,9.0.4.0,9.0.4.1,and avoid the version 9.0.2,9.0.2.0.0,9.0.2.0.1,9.0.2.1,9.0.2.2,9.0.2.3,9.0.3,9.0.3.1,9.0.4,9.0.4.0,9.0.4.1; Upgrade oracle collaboration_suite to a higher version than release_1,and avoid the version release_1; Upgrade oracle e-business_suite to a higher version than 11.5.1,11.5.2,11.5.3,11.5.4,11.5.5,11.5.6,11.5.7,11.5.8,11.5.9,and avoid the version 11.5.1,11.5.2,11.5.3,11.5.4,11.5.5,11.5.6,11.5.7,11.5.8,11.5.9; Upgrade oracle enterprise_manager to a higher version than 9,9.0.1,and avoid the version 9,9.0.1; Upgrade oracle enterprise_manager_database_control to a higher version than 10.1.2,and avoid the version 10.1.2; Upgrade oracle enterprise_manager_grid_control to a higher version than 10.1.0.2,and avoid the version 10.1.0.2; Upgrade oracle oracle10g to a higher version than enterprise_9.0.4_.0,enterprise_10.1.0.2,personal_9.0.4_.0,personal_10.1_.0.2,standard_9.0.4_.0,standard_10.1_.0.2,and avoid the version enterprise_9.0.4_.0,enterprise_10.1.0.2,personal_9.0.4_.0,personal_10.1_.0.2,standard_9.0.4_.0,standard_10.1_.0.2; Upgrade oracle oracle8i to a higher version than enterprise_8.0.5_.0.0,enterprise_8.0.6_.0.0,enterprise_8.0.6_.0.1,enterprise_8.1.5_.0.0,enterprise_8.1.5_.0.2,enterprise_8.1.5_.1.0,enterprise_8.1.6_.0.0,enterprise_8.1.6_.1.0,enterprise_8.1.7_.0.0,enterprise_8.1.7_.1.0,enterprise_8.1.7_.4,standard_8.0.6,standard_8.0.6_.3,standard_8.1.5,standard_8.1.6,standard_8.1.7,standard_8.1.7_.0.0,standard_8.1.7_.1,standard_8.1.7_.4,and avoid the version enterprise_8.0.5_.0.0,enterprise_8.0.6_.0.0,enterprise_8.0.6_.0.1,enterprise_8.1.5_.0.0,enterprise_8.1.5_.0.2,enterprise_8.1.5_.1.0,enterprise_8.1.6_.0.0,enterprise_8.1.6_.1.0,enterprise_8.1.7_.0.0,enterprise_8.1.7_.1.0,enterprise_8.1.7_.4,standard_8.0.6,standard_8.0.6_.3,standard_8.1.5,standard_8.1.6,standard_8.1.7,standard_8.1.7_.0.0,standard_8.1.7_.1,standard_8.1.7_.4; Upgrade oracle oracle9i to a higher version than client_9.2.0.1,client_9.2.0.2,enterprise_8.1.7,enterprise_9.0.1,enterprise_9.0.1.4,enterprise_9.0.1.5,enterprise_9.2.0,enterprise_9.2.0.1,enterprise_9.2.0.2,enterprise_9.2.0.3,enterprise_9.2.0.4,enterprise_9.2.0.5,personal_8.1.7,personal_9.0.1,personal_9.0.1.4,personal_9.0.1.5,personal_9.2,personal_9.2.0.1,personal_9.2.0.2,personal_9.2.0.3,personal_9.2.0.4,personal_9.2.0.5,standard_8.1.7,standard_9.0,standard_9.0.1,standard_9.0.1.2,standard_9.0.1.3,standard_9.0.1.4,standard_9.0.1.5,standard_9.0.2,standard_9.2,standard_9.2.0.1,standard_9.2.0.2,standard_9.2.0.3,standard_9.2.0.4,standard_9.2.0.5,and avoid the version client_9.2.0.1,client_9.2.0.2,enterprise_8.1.7,enterprise_9.0.1,enterprise_9.0.1.4,enterprise_9.0.1.5,enterprise_9.2.0,enterprise_9.2.0.1,enterprise_9.2.0.2,enterprise_9.2.0.3,enterprise_9.2.0.4,enterprise_9.2.0.5,personal_8.1.7,personal_9.0.1,personal_9.0.1.4,personal_9.0.1.5,personal_9.2,personal_9.2.0.1,personal_9.2.0.2,personal_9.2.0.3,personal_9.2.0.4,personal_9.2.0.5,standard_8.1.7,standard_9.0,standard_9.0.1,standard_9.0.1.2,standard_9.0.1.3,standard_9.0.1.4,standard_9.0.1.5,standard_9.0.2,standard_9.2,standard_9.2.0.1,standard_9.2.0.2,standard_9.2.0.3,standard_9.2.0.4,standard_9.2.0.5