Vulnerability Description
Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mariadb | Mariadb | 5.1.66 |
| Oracle | Mysql | 5.5.19 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
- http://seclists.org/fulldisclosure/2012/Dec/9
- http://secunia.com/advisories/53372
- http://security.gentoo.org/glsa/glsa-201308-06.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:102
- http://www.openwall.com/lists/oss-security/2012/12/02/3
- http://www.openwall.com/lists/oss-security/2012/12/02/4
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- https://mariadb.atlassian.net/browse/MDEV-3909
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
- http://seclists.org/fulldisclosure/2012/Dec/9
- http://secunia.com/advisories/53372
FAQ
What is CVE-2012-5615?
CVE-2012-5615 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending o...
How severe is CVE-2012-5615?
CVE-2012-5615 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-5615?
Check the references section above for vendor advisories and patch information. Affected products include: Mariadb Mariadb, Oracle Mysql.