CVE-2012-3137
MEDIUM severity · CVSS 6.4 · Improper authentication
6.4CVSS MEDIUM
Summary
The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impactNone
Exploit probability (EPSS)31%
AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html ↗
Additional information
- NVD record
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlPatch
- http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/
- http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular
- http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
- http://www.securityfocus.com/bid/55651
- http://www.exploit-db.com/exploits/22069Advisory