Vulnerability - Oracle toplink mapping workbench password algorithm

Question

Could someone from Oracle post security contact info. This is regarding a possible vulnerability in TopLink referred to in this posting:
http://marc.theaimsgroup.com/?l=bugtraq&m=107531028325112&w=2
I would like to know Oracle's response to this item before I publish a report to our clients.
Thanks,
Mark Hoffman

Answer 1

It has come to our attention that a 3rd party has published the algorithm used to obfuscate a database password stored in the runtime configuration file (project.xml or java source file) generated by the TopLink Mapping Workbench version 9.0.3.
This database password is NOT used when TopLink is using an application server’s database connection pool and this issue does not apply. In this case TopLink uses a specified data source name and the application server manages the database password.
For those not using the app server connection pool, the obfuscation is not meant to offer encryption protection for the password stored in the file. It is a mechanism meant to make the password in the file unreadable to the naked eye. It is not a replacement for proper file permission and access control to protect the file.
It is an optional convenience feature that customers have requested as they have found it to be useful during development and internal testing. The only way the password is saved in the file is if the option that is explicitly marked “Save Password (Unencrypted)” is used.
For encrypted security protection using technology such as Java Cryptography Extension (JCE), the unencrypted password can be set using APIs provided in the TopLink runtime libraries. A code example follows:
boolean shouldLoginSession = false;
DatabaseSession session = null;
session = (DatabaseSession)SessionManager.getManager().getSession("MySessionName", shouldLoginSession);
String password = //retrieve the password as an unencrypted string from somewhere
session.getLogin().setPassword(password); //note this assumes that the user is already set in the project
session.login();
Guidelines:
1.     If you are using the application server’s database connection pool, this issue does not apply. TopLink simply specifies a data source name and the application server manages, stores and encrypts the password.
2.     If you are not using the application server’s database connection pool, use the optional Mapping Workbench feature to store the password in the project.xml or java source file for development or internal testing purposes only if there is proper file permission and access control to protect the file.
3.     For deployment or unsecured development environments utilize the TopLink API’s provided that allow secure password encryption technology to be used.
This issue only applies to version 9.0.3 and prior; in 9.0.4 the TopLink Mapping Workbench uses JCE to encrypt the file.
Regards,
Dennis Leung
Oracle Corp.