CVE-2012-5615: Infoleak

Published Dec 3, 2012

Updated

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.

Affected Software

5 affected components

MariaDB MariaDB=5.1.66

MariaDB MariaDB=5.2.13

MariaDB MariaDB=5.3.11

MariaDB MariaDB=5.5.28a

ORACLE MySQL=5.5.19

Event History

Dec 3, 2012

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-5615?

CVE-2012-5615 is considered a medium severity vulnerability due to its potential for user enumeration.

How do I fix CVE-2012-5615?

To fix CVE-2012-5615, upgrade to MySQL versions 5.5.39 or later, or MariaDB versions 5.5.28b or later.

What type of attack does CVE-2012-5615 enable?

CVE-2012-5615 enables remote attackers to perform username enumeration attacks.

Which software versions are affected by CVE-2012-5615?

CVE-2012-5615 affects Oracle MySQL versions 5.5.38 and earlier, and several MariaDB versions including 5.1.66 and prior.

How can I detect CVE-2012-5615 on my system?

You can detect CVE-2012-5615 by checking your MySQL or MariaDB version against the affected versions listed in the vulnerability description.