CVE-2012-3137

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

CVSS v2.0

6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

EPSS

31.44% chance of exploitation in the next 30 days, 98th percentile

Published

2012-09-21

Updated

2024-08-06

Proof-of-concept exploits (3)

• http://www.exploit-db.com/exploits/22069
• hantwister/o5logon-fetch3★ · 2014-03-29
• r1-/cve-2012-31374★ · 2014-06-30

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/22069

References

• CVE Record
• NVD entry

Related

• CVE-2012-3001
• CVE-2012-3152
• CVE-2012-2998
• CVE-2012-3153
• CVE-2012-2997
• CVE-2012-3183