CVE-2012-3137: The authentication protocol in Oracle Database… (CVSS 6.4)

Description

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

Exploit likelihood

31.4%Down 19.4 points since Feb 4, 2022

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Oracle Database - Protocol Authentication Bypass	2012-10-18
PoC in GitHub	hantwister/o5logon-fetch	2014-03-29
PoC in GitHub	r1-/cve-2012-3137	2014-06-18

What each source reports

NVD Score used6.4

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

Record: CVE-2012-3137
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness: CWE-287
Updated: 2026-11-02

CVE ListNo score

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

Record: CVE-2012-3137
Updated: 2026-11-02

EUVDEUVD-2012-3115No score

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

Record: EUVD-2012-3115
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5gqh-48pf-m5xxNo score

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11...

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

Record: GHSA-5gqh-48pf-m5xx
Weakness: CWE-287
Updated: 2026-11-02

OSVSUSE-SU-2015:0498-1No score

Security update for oracle-update

This critical patch update contains 5 security fixes for the Oracle Database Server. One of the vulnerabilities could have been exploited over the network without a valid username and password.

Security Issues:

* CVE-2013-3751
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3751>
* CVE-2013-3774
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3774>
* CVE-2014-4236
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4236>
* CVE-2014-4237
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4237>
* CVE-2014-4245
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4245>

Record: SUSE-SU-2015:0498-1
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 52 moreShow less