Check out the ORA_NLS33 variable may be its pointing to a non-existent directory or a directory that does not have the character-set files installed or the directory permissions are not set.

If the remote database is set to a character set other than the 'US7ASCII' (default) the client need to be set to the same character set.
If not, the SQL*Net layer will intersperse all characters sent to the server with a 'null' character. For this reason, the server believes a null password has been sent.