Re: Oracle Hyperion password disclosure...

[jeff.kayser@xxxxxxxxxxxxxxxxxx]

Sorry for the earlier attachment.  Here is what I wanted to communicate.

Jeff Kayser
Jibe Consulting | Oracle Principal Consultant
5000 Meadows Rd. Suite 300
Lake Oswego, OR 97035
O: 503-517-3266 | C: 503.901.5021
Jeff.kayser@xxxxxxxxxxxxxxxxxx


-----Original Message-----
From: Jeff Kayser 
Sent: Friday, September 04, 2015 10:46 AM
To: 'bugtraq@xxxxxxxxxxxxxxxxx' <bugtraq@xxxxxxxxxxxxxxxxx>
Cc: bruce lowenthal (bruce.lowenthal@xxxxxxxxxx) <bruce.lowenthal@xxxxxxxxxx>; 
Jeff Kayser (jeff.kayser@xxxxxxxxxxxxxxxxxx) <jeff.kayser@xxxxxxxxxxxxxxxxxx>
Subject: Oracle Hyperion password disclosure

Hello, all.
 
Oracle Hyperion Rapid Deploy installer leaves plaintext passwords in 
configuration files and logfiles.  Oracle has known about this issue for 2 
years (see below).  Oracle says they have fixed the issue in the Hyperion 
11.1.2.4 (the latest version).  I have not verified the fix.  Oracle has 
decided not to patch previous versions.  Customers running Oracle Hyperion are 
advised to review configuration files and logfiles for presence of passwords, 
and redact the passwords as appropriate.

Jeff Kayser
Jibe Consulting | Oracle Principal Consultant
5000 Meadows Rd. Suite 300
Lake Oswego, OR 97035
O: 503-517-3266 | C: 503.901.5021
Jeff.kayser@xxxxxxxxxxxxxxxxxx


From: Oracle Security Alerts [mailto:secalert_us@xxxxxxxxxx] 
Sent: Wednesday, September 02, 2015 1:04 PM
To: Jeff Kayser <jeff.kayser@xxxxxxxxxxxxxxxxxx>
Subject: Re: Fwd: Fwd: Re: SR 3-7766764311 : Hyperion Essbase Rapid Deploy: 
passwords disclosed in install logfiles

Hi Jeff,
           I wanted to follow up on this issue. This issue was fixed in the 
latest version of Hyperion (11.1.2.4) before it was GA . 

         The 'Rapid Deployment Installer' is not supported for use in a 
Production environment. The documentation for  11.1.2.4 and 11.1.2.3 about 
Rapid Deployment reflects this. Hence we do not plan to release any patches for 
11.1.2.3 , which is the version that introduced Rapid Deployment.

         Please let us know if you have any questions or concerns about this.

Thank you,
Umang Desai
Oracle Security Alerts

On 9/6/2013 1:01 PM, Oracle Security Alerts wrote:
Hi Jeff,

Thanks very much for the confirmation, much appreciated. We will evaluate other 
Hyperion products to make sure that we fix the clear-text password issue in all 
affected-supported product-release combinations. Once the issue is ready to be 
published in a CPU, we will give you credit in our advisory. You will receive 
monthly status update notes from us and we will also notify you once the issue 
is ready to be published.


-- 
Thanks,
-Ritwik

--
Best Regards,
Oracle Security Alerts


From: bruce lowenthal [mailto:bruce.lowenthal@xxxxxxxxxx] 
Sent: Wednesday, September 04, 2013 8:02 PM
To: Jeff Kayser <jeff.kayser@xxxxxxxxxxxxxxxxxx>; Chok Poh 
<chok.poh@xxxxxxxxxx>; NAGABHUSHAN.K.N@xxxxxxxxxx
Subject: Re: SR 3-7766764311 : Hyperion Essbase Rapid Deploy: passwords 
disclosed in install logfiles

Jeff:

Thanks for the input.    I'd like to see if we can handle this properly without 
needing outside encouragement unlike the E-Business Suite issue.

Chok:  Can you please make sure this Hyperion SR gets properly and 
expeditiously handled?  The last person that handled this SR was 
NAGABHUSHAN.K.N@xxxxxxxxxx.   Can you get me a status on Friday at the 10AM 
meeting.

Thanks
Bruce

On 9/4/2013 7:13 PM, Jeff Kayser wrote:
FYI
 
SR 3-7766764311 : Hyperion Essbase Rapid Deploy: passwords disclosed in install 
logfiles
 
Jeff Kayser
Jibe Consulting | Oracle Principal Consultant
5000 Meadows Rd. Suite 300
Lake Oswego, OR 97035
O: 503-517-3266 | C: 503.901.5021
Jeff.kayser@xxxxxxxxxxxxxxxxxx