Vulnerability Description
The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Database Server | 10.2.0.3 |
| Oracle | Primavera P6 Enterprise Project Portfolio Management | 8.2 |
Related Weaknesses (CWE)
References
- http://arstechnica.com/security/2012/09/oracle-database-stealth-password-crackinPress/Media Coverage
- http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-passwordPress/Media Coverage
- http://www.darkreading.com/authentication/167901072/security/application-securitPress/Media Coverage
- http://www.exploit-db.com/exploits/22069ExploitThird Party AdvisoryVDB Entry
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150Broken Link
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatchVendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlPatchVendor Advisory
- http://www.securityfocus.com/bid/55651
- http://arstechnica.com/security/2012/09/oracle-database-stealth-password-crackinPress/Media Coverage
- http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-passwordPress/Media Coverage
- http://www.darkreading.com/authentication/167901072/security/application-securitPress/Media Coverage
- http://www.exploit-db.com/exploits/22069ExploitThird Party AdvisoryVDB Entry
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150Broken Link
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatchVendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlPatchVendor Advisory
FAQ
What is CVE-2012-3137?
CVE-2012-3137 is a vulnerability with a CVSS score of 6.4 (MEDIUM). The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, whi...
How severe is CVE-2012-3137?
CVE-2012-3137 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-3137?
Check the references section above for vendor advisories and patch information. Affected products include: Oracle Database Server, Oracle Primavera P6 Enterprise Project Portfolio Management.