| Vulnerability Name: | CVE-2012-3137 (CCN-78799) | ||||||||
| Assigned: | 2012-09-20 | ||||||||
| Published: | 2012-09-20 | ||||||||
| Updated: | 2016-11-28 | ||||||||
| Summary: | The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability." | ||||||||
| CVSS v3 Severity: | 6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N) 5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N/E:POC/RL:OF/RC:C)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N/E:POC/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-287 | ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: MISC Type: Press/Media Coverage http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/ Source: MITRE Type: CNA CVE-2012-3137 Source: CCN Type: Packetstorm Security Website Oracle Database Authentication Protocol Security Bypass Source: MISC Type: Press/Media Coverage http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular Source: MISC Type: Press/Media Coverage http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 22069 Source: MANDRIVA Type: Broken Link MDVSA-2013:150 Source: CCN Type: Oracle Web site Oracle Database Source: CCN Type: Oracle CPUJul2016 Oracle Critical Patch Update Advisory - July 2016 Source: CONFIRM Type: Patch, Vendor Advisory http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Source: CONFIRM Type: Patch, Vendor Advisory http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Source: BID Type: UNKNOWN 55651 Source: CCN Type: BID-55651 Oracle Database Authentication Protocol CVE-2012-3137 Security Bypass Vulnerability Source: XF Type: UNKNOWN oracle-database-protocol-info-disc(78799) Source: CCN Type: threatpost Flaw in Oracle Logon Protocol Leads to Easy Password Cracking Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [10-18-2012] | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||