{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-09-19T00:00:00", "descriptions": [{"lang": "en", "value": "The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka \"stealth password cracking vulnerability.\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-11-25T19:57:01", "orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"}, {"name": "22069", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/22069"}, {"tags": ["x_refsource_MISC"], "url": "http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular"}, {"tags": ["x_refsource_MISC"], "url": "http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"}, {"name": "55651", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/55651"}, {"name": "MDVSA-2013:150", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2012-3137", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka \"stealth password cracking vulnerability.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html", "refsource": "MISC", "url": "http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html"}, {"name": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"}, {"name": "22069", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/22069"}, {"name": "http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular", "refsource": "MISC", "url": "http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular"}, {"name": "http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/", "refsource": "MISC", "url": "http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/"}, {"name": "http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"}, {"name": "55651", "refsource": "BID", "url": "http://www.securityfocus.com/bid/55651"}, {"name": "MDVSA-2013:150", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T19:57:50.340Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"}, {"name": "22069", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "http://www.exploit-db.com/exploits/22069"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"}, {"name": "55651", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/55651"}, {"name": "MDVSA-2013:150", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}]}]}, "cveMetadata": {"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "assignerShortName": "oracle", "cveId": "CVE-2012-3137", "datePublished": "2012-09-21T23:00:00", "dateReserved": "2012-06-06T00:00:00", "dateUpdated": "2024-08-06T19:57:50.340Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:database_server:10.2.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "ED41086B-840A-4B39-B249-461A4B00B57B", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:database_server:10.2.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "E4AC251D-9313-4A54-9623-51DC0AEC46FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:database_server:10.2.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "9ACC1D6F-2EDD-4DAA-B9CE-CF516C2B35C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:database_server:11.1.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "EDEDE937-C3D7-421C-9F70-F546AB823E1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:database_server:11.2.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "3D7157D8-4959-4F6C-BFA0-D80862393AA4", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:database_server:11.2.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "165A1F85-076B-4216-8EF8-D67E6EC63A6B", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.2:*:*:*:*:*:*:*", "matchCriteriaId": "A56DC460-26F5-453E-A5BC-4C60AA3212EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.3:*:*:*:*:*:*:*", "matchCriteriaId": "A47BF03C-BF18-4477-9DBB-20EFEA53AFAB", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.4:*:*:*:*:*:*:*", "matchCriteriaId": "84BF6794-2CE6-407F-B8E0-81871AB7B40B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka \"stealth password cracking vulnerability.\""}, {"lang": "es", "value": "El protocolo de autenticaci\u00f3n en Oracle Database 11g 1 y 2 permite a atacantes remotos obtener la clave y la \"salt\" de sesi\u00f3n para usuarios de su elecci\u00f3n, lo cual provoca fugas de informaci\u00f3n sobre el hash criptogr\u00e1fico y hace que sea m\u00e1s f\u00e1cil ataques de fuerza bruta para adivinar la contrase\u00f1a. Se trata de un problema tambi\u00e9n conocido como \"vulnerabilidad de ruptura de contrase\u00f1as\"."}], "id": "CVE-2012-3137", "lastModified": "2016-11-28T19:08:13.263", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-09-21T23:55:01.230", "references": [{"source": "secalert_us@oracle.com", "tags": ["Press/Media Coverage"], "url": "http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/"}, {"source": "secalert_us@oracle.com", "tags": ["Press/Media Coverage"], "url": "http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular"}, {"source": "secalert_us@oracle.com", "tags": ["Press/Media Coverage"], "url": "http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html"}, {"source": "secalert_us@oracle.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://www.exploit-db.com/exploits/22069"}, {"source": "secalert_us@oracle.com", "tags": ["Broken Link"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}, {"source": "secalert_us@oracle.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"}, {"source": "secalert_us@oracle.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"}, {"source": "secalert_us@oracle.com", "url": "http://www.securityfocus.com/bid/55651"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "oracle-server: Authentication protocol allows session key and salt for arbitrary users (\"stealth password cracking vulnerability\")", "id": "859935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=859935"}, "csaw": false, "cvss": {"cvss_base_score": "6.4", "cvss_scoring_vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "status": "draft"}, "details": ["The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka \"stealth password cracking vulnerability.\""], "name": "CVE-2012-3137", "package_state": [{"cpe": "cpe:/a:redhat:network_satellite:5.4", "fix_state": "Not affected", "package_name": "Server", "product_name": "Red Hat Satellite 5.4"}], "public_date": "2012-09-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-3137\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-3137"], "statement": "Not vulnerable. This issue did not affect the version of the oracle-server package as shipped with Red Hat Network Satellite 5.4.", "threat_severity": "Important"}