CVE-2012-3137
CVE-2012-3137
The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."
Affected products
n/a · n/apublic PoCs found — 4
githubgithub.com/r1-/cve-2012-3137★ 4githubgithub.com/hantwister/o5logon-fetch★ 3cve_referencewww.exploit-db.com/exploits/22069unverifiedexploitdbwww.exploit-db.com/exploits/22069unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popularhttp://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.htmlhttp://www.exploit-db.com/exploits/22069http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlhttp://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlhttp://www.securityfocus.com/bid/55651