<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16705" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2>
<H2 class=subtitle>Oracle PeopleTools – Authentication Weakness</H2>
<P>
<H2 class=subtitle2>Background</H2><BR>PeopleSoft Enterprise applications
architecture is built around the proprietary PeopleTools technology. PeopleTools
user authentication mechanism requires a user to provide the correct credentials
in order to gain access through the web interface. An account lockout policy
disables a user account if an incorrect password is entered a specified number
of times over a specified period.
<P></P>
<P>
<H2 class=subtitle2>Scope</H2><BR>Imperva’s Application Defense Center conducts
extensive research on enterprise applications on behalf of its customers,
including research on applications like PeopleSoft, SAP and Oracle EBS. During
its research, the team has identified a security flaw related to PeopleTools
authentication mechanism and account lock-out policy.
<P></P>
<P>
<H2 class=subtitle2>Findings</H2><BR>By observing the system’s response to
repeated authentication attempts, an attacker can brute force valid user
credentials even though the account lock-out mechanism is enabled. The attacker
could use the compromised credentials once the account is unlocked by an
administrator.
<P></P>
<P>
<H2 class=subtitle2>Details</H2><BR>Upon a false login attempt, the message
“Your User ID and/or Password are invalid” is returned to the user. When the
correct password is entered, and the account has been locked, the message “Your
account has been disabled” is returned. Therefore an attacker can conduct a
brute force attack even after the account has been locked. <BR><BR>Once the
account is unlocked, PeopleTools does not enforce password changing. Therefore
the compromised set of credentials can be used to break into the unlocked
account.
<P></P>
<P>
<H2 class=subtitle2>Exploit</H2><BR>Brute force login to the application until
the correct password is detected.
<P></P>
<P>
<H2 class=subtitle2>Vulnerability ID</H2><BR>CVE-2008-4000
<P></P>
<P>
<H2 class=subtitle2>Tested Versions</H2><BR><B>Vulnerable</B><BR>PeopleTools
8.49 (8.4x)
<P></P>
<P>
<H2 class=subtitle2>Vendor's Status</H2><BR>Vendor notified on August 4, 2008.
Patch released by vendor on October 14, 2008.
<P></P>
<P>
<H2 class=subtitle2>Workaround</H2><BR>
<UL>
<LI>Within PeopleSoft, select the “Enable password controls” checkbox and then
define the number of days that a password is valid. The actual number of days
does not matter for this purpose.
<LI>When an account is locked because of too many login attempts, the
administrator can unlock the account and then manually set the status of the
password for the account to “expired”. This will force the user to change the
password during the next login.
<LI>An alternative workaround is to create a custom Web application policy in
the SecureSphere Web Application Firewall. The policy match criteria would
include the URL prefix of the PeopleSoft login page (the action URL for the
authentication form) and the number of occurrences within a specified period
of time.</LI></UL>
<P></P>
<P>
<H2 class=subtitle2>Discovered by:</H2><BR>Yaniv Azaria of Imperva’s ADC
<P></P>
<H2 class=subtitle2>Disclaimer</H2>
<P>The information within this advisory is subject to change without notice. Use
of this information constitutes acceptance for use in an AS IS condition. Any
use of this information is at the user’s own risk. There are no warranties,
implied or expressed, with regard to this information. In no event shall the
author be liable for any direct or indirect damages whatsoever arising out of or
in connection with the use or spread of this information.</P>Copyright © 2007
Imperva, Inc.<BR>Redistribution of this alert electronically is allowed as long
as it is not edited in any way. To reprint this alert, in whole or in part, in
any medium other than electronic medium, <A
href="mailto:adc@imperva.com">adc@imperva.com</A> for permission.</FONT></DIV>
<DIV> </DIV>
<DIV dir=ltr align=left><STRONG><FONT face=Arial color=#0000ff size=2>Amichai
Shulman</FONT></STRONG></DIV>
<DIV dir=ltr align=left><STRONG><FONT face=Arial color=#0000ff
size=2>CTO</FONT></STRONG></DIV>
<DIV dir=ltr align=left><SPAN
style="FONT-SIZE: 8.5pt; COLOR: #2f506d; FONT-FAMILY: Verdana"></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN
style="FONT-SIZE: 8.5pt; COLOR: #2f506d; FONT-FAMILY: Verdana">125 Menachem
Begin St.<BR>Tel Aviv 67010<BR>Israel<?xml:namespace prefix = o ns =
"urn:schemas-microsoft-com:office:office" /><o:p></o:p></SPAN></DIV>
<DIV dir=ltr align=left>
<P><SPAN style="FONT-SIZE: 8.5pt; COLOR: #2f506d; FONT-FAMILY: Verdana">(972)
3-6840103 Office<BR>(972) 54-5885083 Mobile<BR>(972) 3-6840200 Fax<BR><A
title=mailto:shulman@imperva.com
href="mailto:shulman@imperva.com">shulman@imperva.com</A><o:p></o:p></SPAN></P><SPAN
style="FONT-SIZE: 6.5pt; COLOR: #2f506d; FONT-FAMILY: Verdana; mso-fareast-font-family: 'Times New Roman'; mso-bidi-font-family: 'Times New Roman'; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: HE">Download
Scuba by Imperva<BR>FREE Database Assessment Scanner<BR><A
title=http://www.imperva.com/scubam
href="blocked::http://www.imperva.com/scubam">www.imperva.com/scuba</A></SPAN></DIV>
<DIV> </DIV></BODY></HTML>