EBS APPS password is visible in Stat OA log file in debug mode

When migrating a SQL Script, the OA log shows the APPS password.

This should not be visible in the log.

Hotfix F didn't completely correct the issue.

  • Hi Amanda,

    Historically, Stat Agents debug level was used and should still be used by Stat Agents Administrator or on Support request.
    It is intended to track a more detailed level of what the Agents do in order to solve problematic issues.

    On customer request, for Stat operational cycles (Test connection, archive, migration, etc), Dev hides the APPS password in Stat 6.3 HF-f (STAT-5749),
    which is working as expected.

    Differently and regardless of the Stat operational cycles, when the OA starts, Stat performs a full check on the configuration/connection,
    and the APPS password will be ONLY visible if the OA returns an error because something is missed or wrong including a wrong password,
    helping the Stat Administrator to identify and solve the issue quickly. Does it make sense?

  • Hi Gio,

    Thanks for following up.

    I understand the explanation, however I still don't agree with the reasoning. and would like to see the password removed from the debug log. 

    A couple points to note:

    -  When the password is incorrect, the debug error message already indicates the reason (ex.  Please verify the APPS username and password and listener port and service name in Stat's configuration.  Exception:  ORA-01017: invalid username/password; logon denied).  

    -  When submitting a ticket with Quest Support, the log in debug mode is regularly required.  This continues to present a security issue. 

    -  Internal to our company we have defined roles and the Stat Administrator is not allowed to know the Apps Database password.

  • I logged the security defect STAT-5974 on your behalf.

    Please, you can review the next Stat 6.3 Hotfixes Release Notes to verify in which one this defect is solved.

Reply Children
No Data