CVE-2012-3137

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

• CWE-287

• http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/Press/Media Coverage
• http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+PopularPress/Media Coverage
• http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.htmlPress/Media Coverage
• http://www.exploit-db.com/exploits/22069Exploit, Third Party Advisory, VDB Entry
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:150Broken Link
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Vendor Advisory
• http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/55651
• http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/Press/Media Coverage
• http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+PopularPress/Media Coverage
• http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.htmlPress/Media Coverage
• http://www.exploit-db.com/exploits/22069Exploit, Third Party Advisory, VDB Entry
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:150Broken Link
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Vendor Advisory
• http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/55651

Published

Sep 21, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-3131Unspecified vulnerability in Oracle Sun Solaris 9, 10, and 1…
• CVE-2012-3132SQL injection vulnerability in Oracle Database Server 10.2.0…
• CVE-2012-3133Buffer overflow in the DataDirect ODBC driver, as used in Or…
• CVE-2012-3134Unspecified vulnerability in the Core RDBMS component in Ora…
• CVE-2012-3135Unspecified vulnerability in the Oracle JRockit component in…
• CVE-2012-3136Unspecified vulnerability in the Java Runtime Environment (J…
• CVE-2012-3138Unspecified vulnerability in the Oracle iStore component in …
• CVE-2012-3139Unspecified vulnerability in the Oracle Application Object L…
• CVE-2012-3140Unspecified vulnerability in the Oracle Agile PLM For Proces…
• CVE-2012-3141Unspecified vulnerability in the Oracle FLEXCUBE Universal B…
• CVE-2012-3142Unspecified vulnerability in the Oracle FLEXCUBE Direct Bank…
• CVE-2012-3143Unspecified vulnerability in the Java Runtime Environment (J…