{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-12-01T00:00:00", "descriptions": [{"lang": "en", "value": "Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-12-30T16:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "MDVSA-2013:102", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:102"}, {"name": "53372", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/53372"}, {"name": "[oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/12/02/3"}, {"name": "20121201 MySQL Remote Preauth User Enumeration Zeroday", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2012/Dec/9"}, {"name": "GLSA-201308-06", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-201308-06.xml"}, {"name": "[oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/12/02/4"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://mariadb.atlassian.net/browse/MDEV-3909"}, {"name": "SUSE-SU-2015:0743", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html"}, {"name": "SUSE-SU-2013:0262", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T21:14:15.987Z"}, "title": "CVE Program Container", "references": [{"name": "MDVSA-2013:102", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:102"}, {"name": "53372", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/53372"}, {"name": "[oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/12/02/3"}, {"name": "20121201 MySQL Remote Preauth User Enumeration Zeroday", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2012/Dec/9"}, {"name": "GLSA-201308-06", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-201308-06.xml"}, {"name": "[oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/12/02/4"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://mariadb.atlassian.net/browse/MDEV-3909"}, {"name": "SUSE-SU-2015:0743", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html"}, {"name": "SUSE-SU-2013:0262", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-5615", "datePublished": "2012-12-03T11:00:00", "dateReserved": "2012-10-24T00:00:00", "dateUpdated": "2024-08-06T21:14:15.987Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mariadb:mariadb:5.1.66:*:*:*:*:*:*:*", "matchCriteriaId": "3CCF3D67-FAE6-43F4-B546-C7B46992251E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:5.2.13:*:*:*:*:*:*:*", "matchCriteriaId": "62C9A610-F5D7-4DAF-BB63-F062FB48210B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:5.3.11:*:*:*:*:*:*:*", "matchCriteriaId": "DE70C2FA-7E45-4676-A15E-6D07BB97D937", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:5.5.28a:*:*:*:*:*:*:*", "matchCriteriaId": "46E32ACD-E034-4FD6-A54A-43AFDA1AA196", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:mysql:5.5.19:*:*:*:*:*:*:*", "matchCriteriaId": "77E105E9-FE65-4B75-9818-D3897294E941", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames."}, {"lang": "es", "value": "MySQL v5.5.19 y posiblemente otras versiones, y MariaDB v5.5.28a, v5.3.11, v5.2.13, v5.1.66, y posiblemente con otras versiones, generan mensajes de error diferentes con retardos de tiempo diferentes dependiendo de si existe un nombre de usuario, lo que permite atacantes remotos para enumerar los nombres de usuario v\u00e1lidos."}], "id": "CVE-2012-5615", "lastModified": "2023-02-13T04:37:39.843", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-12-03T12:49:43.830", "references": [{"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html"}, {"source": "secalert@redhat.com", "url": "http://seclists.org/fulldisclosure/2012/Dec/9"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/53372"}, {"source": "secalert@redhat.com", "url": "http://security.gentoo.org/glsa/glsa-201308-06.xml"}, {"source": "secalert@redhat.com", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:102"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/12/02/3"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/12/02/4"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"}, {"source": "secalert@redhat.com", "url": "https://mariadb.atlassian.net/browse/MDEV-3909"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2014:1859", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "mysql55-mysql-0:5.5.40-2.el5", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1861", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "mariadb-1:5.5.40-1.el7_0", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1937", "cpe": "cpe:/a:redhat:openstack:5::el6", "package": "mariadb-galera-0:5.5.40-2.el6ost", "product_name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6", "release_date": "2014-12-02T00:00:00Z"}, {"advisory": "RHSA-2014:1940", "cpe": "cpe:/a:redhat:openstack:5::el7", "package": "mariadb-galera-1:5.5.40-2.el7ost", "product_name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7", "release_date": "2014-12-02T00:00:00Z"}, {"advisory": "RHSA-2014:1860", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "mysql55-mysql-0:5.5.40-1.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1862", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "mariadb55-mariadb-0:5.5.40-10.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1860", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "mysql55-mysql-0:5.5.40-1.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1862", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "mariadb55-mariadb-0:5.5.40-10.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1860", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "mysql55-mysql-0:5.5.40-1.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1862", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "mariadb55-mariadb-0:5.5.40-10.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1860", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "mysql55-mysql-0:5.5.40-1.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1862", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "mariadb55-mariadb-0:5.5.40-10.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1860", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el7", "package": "mysql55-mysql-0:5.5.40-1.el7", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 7", "release_date": "2014-11-17T00:00:00Z"}, {"advisory": "RHSA-2014:1862", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el7", "package": "mariadb55-mariadb-0:5.5.40-10.el7", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 7", "release_date": "2014-11-17T00:00:00Z"}], "bugzilla": {"description": "mysql: Remote Preauth User Enumeration flaw", "id": "882608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=882608"}, "csaw": false, "cvss": {"cvss_base_score": "3.5", "cvss_scoring_vector": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "status": "verified"}, "cwe": "CWE-209", "details": ["Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames."], "name": "CVE-2012-5615", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "mysql", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2012-12-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-5615\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-5615"], "threat_severity": "Low"}