CVEvulnerability

CVE-2012-3137

6.4 MEDIUM Published 2012-09-21 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-09-21
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-287

Description

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

Affected configurations

• oracle database server 10.2.0.3 • oracle database server 10.2.0.4 • oracle database server 10.2.0.5 • oracle database server 11.1.0.7 • oracle database server 11.2.0.2 • oracle database server 11.2.0.3 • oracle primavera p6 enterprise project portfolio management 8.2 • oracle primavera p6 enterprise project portfolio management 8.3 • oracle primavera p6 enterprise project portfolio management 8.4

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References