CVE-2012-3137

published 2012-09-21

CVE-2012-3137: The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the…

Priority P2 61 medium 6.4 CVSS 2.0

AV N AC L Au N C P I P A N

EXPLOIT

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

Affected

9 ranges

Vendor	Product	Version range	Fixed in
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle	primavera_p6_enterprise_project_portfolio_management	—	—
oracle	primavera_p6_enterprise_project_portfolio_management	—	—
oracle	primavera_p6_enterprise_project_portfolio_management	—	—

Detection & IOCs extracted from sources · hover to see the quote

command decrypt(session_hex.decode('hex'), salt_hex.decode('hex'), password)↗

bytes↗

\x08\x08\x08\x08\x08\x08\x08\x08

• → An unauthenticated remote attacker can request the session key and salt for ANY arbitrary user without completing authentication — monitor for Oracle TNS authentication requests that do not result in a completed login session, as these may indicate session key/salt harvesting. ↗
• → Successful password recovery is confirmed by checking that the last 8 bytes of the decrypted 48-byte session blob equal 0x08 repeated 8 times (PKCS-style padding); this is a distinguishing oracle condition usable in a Sigma/YARA rule on memory or network captures. ↗
• → Affected versions are Oracle Database 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 — scope detection rules to these specific version strings in Oracle listener banners or audit logs. ↗

• · Red Hat Network Satellite 5.4's oracle-server package is explicitly NOT affected; do not apply Oracle DB detection rules to that product. ↗
• · The exploit PoC targets only Oracle 11g R1 and R2 for the authentication bypass path, though the session-key/salt leakage affects 10g versions as well per NVD. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287