Auth bypass in Oracle Database Server
CVE-2012-3137
The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.4 (Medium). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.314 (98.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.314 · newest: 0.314 · change: 0.000
Affected products
- Oracle Database Server — versions 10.2.0.3, 10.2.0.4, 10.2.0.5
- Oracle Primavera P6 Enterprise Project Portfolio Management — versions 8.2, 8.3, 8.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.darkreading.com/authentication/167901072/security/application-security/2400… (Press/Media Coverage)
- www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html (Patch, Vendor Advisory)
- www.exploit-db.com/exploits/22069 (Exploit, VDB Entry, Third Party Advisory, exploit)
- threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-crack… (Press/Media Coverage)
- arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vuln… (Press/Media Coverage)
- www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html (Patch, Vendor Advisory)
- www.securityfocus.com/bid/55651 (vdb-entry)
- www.mandriva.com/security/advisories (vendor-advisory, Broken Link)
Frequently asked questions
- What is CVE-2012-3137?
- CVE-2012-3137 is a vulnerability in Oracle Database Server, classified under Improper Authentication. Published 2012-09-21.
- Is CVE-2012-3137 known to be exploited?
- 17 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.