CVE-2012-5615
Vulnerability from cvelistv5
Published
2012-12-03 11:00
Modified
2024-08-06 21:14
Severity ?
Summary
Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.
References
secalert@redhat.comhttp://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html
secalert@redhat.comhttp://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
secalert@redhat.comhttp://seclists.org/fulldisclosure/2012/Dec/9
secalert@redhat.comhttp://secunia.com/advisories/53372
secalert@redhat.comhttp://security.gentoo.org/glsa/glsa-201308-06.xml
secalert@redhat.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:102
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/12/02/3
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/12/02/4
secalert@redhat.comhttp://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
secalert@redhat.comhttp://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
secalert@redhat.comhttps://mariadb.atlassian.net/browse/MDEV-3909
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2012/Dec/9
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/53372
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-201308-06.xml
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2013:102
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/12/02/3
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/12/02/4
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
af854a3a-2127-422b-91ae-364da2661108https://mariadb.atlassian.net/browse/MDEV-3909
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:14:15.987Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "MDVSA-2013:102",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:102"
          },
          {
            "name": "53372",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/53372"
          },
          {
            "name": "[oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based  buffer overrun PoC Zeroday",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/12/02/3"
          },
          {
            "name": "20121201 MySQL Remote Preauth User Enumeration Zeroday",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2012/Dec/9"
          },
          {
            "name": "GLSA-201308-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201308-06.xml"
          },
          {
            "name": "[oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based  buffer overrun PoC Zeroday",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/12/02/4"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://mariadb.atlassian.net/browse/MDEV-3909"
          },
          {
            "name": "SUSE-SU-2015:0743",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html"
          },
          {
            "name": "SUSE-SU-2013:0262",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-12-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-30T16:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "MDVSA-2013:102",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:102"
        },
        {
          "name": "53372",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/53372"
        },
        {
          "name": "[oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based  buffer overrun PoC Zeroday",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/12/02/3"
        },
        {
          "name": "20121201 MySQL Remote Preauth User Enumeration Zeroday",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2012/Dec/9"
        },
        {
          "name": "GLSA-201308-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201308-06.xml"
        },
        {
          "name": "[oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based  buffer overrun PoC Zeroday",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/12/02/4"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://mariadb.atlassian.net/browse/MDEV-3909"
        },
        {
          "name": "SUSE-SU-2015:0743",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html"
        },
        {
          "name": "SUSE-SU-2013:0262",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-5615",
    "datePublished": "2012-12-03T11:00:00",
    "dateReserved": "2012-10-24T00:00:00",
    "dateUpdated": "2024-08-06T21:14:15.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2012-5615\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2012-12-03T12:49:43.830\",\"lastModified\":\"2024-11-21T01:44:58.720\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.\"},{\"lang\":\"es\",\"value\":\"MySQL v5.5.19 y posiblemente otras versiones, y MariaDB v5.5.28a, v5.3.11, v5.2.13, v5.1.66, y posiblemente con otras versiones, generan mensajes de error diferentes con retardos de tiempo diferentes dependiendo de si existe un nombre de usuario, lo que permite atacantes remotos para enumerar los nombres de usuario v\u00e1lidos.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:5.1.66:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3CCF3D67-FAE6-43F4-B546-C7B46992251E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:5.2.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"62C9A610-F5D7-4DAF-BB63-F062FB48210B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:5.3.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE70C2FA-7E45-4676-A15E-6D07BB97D937\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:5.5.28a:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46E32ACD-E034-4FD6-A54A-43AFDA1AA196\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.5.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"77E105E9-FE65-4B75-9818-D3897294E941\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://seclists.org/fulldisclosure/2012/Dec/9\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/53372\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-201308-06.xml\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2013:102\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/12/02/3\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/12/02/4\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://mariadb.atlassian.net/browse/MDEV-3909\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/fulldisclosure/2012/Dec/9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/53372\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-201308-06.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2013:102\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/12/02/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/12/02/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://mariadb.atlassian.net/browse/MDEV-3909\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}