CVE-2012-5615 Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending o...
MediumCVSS 5.0
EPSS 14.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| MariaDB Server | = 5.1.66 | No fix listed |
| MariaDB Server | = 5.2.13 | No fix listed |
| MariaDB Server | = 5.3.11 | No fix listed |
| MariaDB Server | = 5.5.28a | No fix listed |
| oracle MySQL | = 5.5.19 | No fix listed |
References
- SUSE-SU-2013:0262 vendor-advisory
- SUSE-SU-2015:0743 vendor-advisory
- 20121201 MySQL Remote Preauth User Enumeration Zeroday mailing-list
- 53372 third-party-advisory
- GLSA-201308-06 vendor-advisory
- MDVSA-2013:102 vendor-advisory
- [oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday mailing-list
- [oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday mailing-list
- www.oracle.com
- www.oracle.com
- mariadb.atlassian.net