This issue is due to the presence of Cisco bug ID CSCsf32615.
When this issue occurs, the graphical user interface (GUI) login page sometimes becomes distorted, and the attempts to run most command line interface (CLI) commands result in a password error, for example the ORA-01005: null password given; logon denied. error message.
This issue occurs when the / (root) partition fills to 100 percent capacity, which can be checked in version 4.2.1 or later with the diskusage command. The command output contains a list of partitions. Usually the first partition is the root partition and its %use column is 100.
This issue occurs most often in these versions of the Cisco Security Monitoring, Analysis and Response System (CS-MARS):
The only workaround available is to download and install CS-MARS version 4.2.3 in which the bug is fixed.