CVE-2012-5615

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 96%
Affected Products (NVD)
VendorProductVersion
mariadbmariadb
5.1.66
mariadbmariadb
5.2.13
mariadbmariadb
5.3.11
mariadbmariadb
5.5.28a:a
oraclemysql
5.5.19
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
mariadb-5.5
lucid
dne
precise
dne
trusty
dne
utopic
not-affected
vivid
dne
wily
dne
mysql-5.5
hardy
dne
lucid
dne
oneiric
dne
precise
Fixed 5.5.40-0ubuntu0.12.04.1
released
quantal
ignored
raring
ignored
saucy
ignored
trusty
Fixed 5.5.40-0ubuntu0.14.04.1
released
utopic
not-affected
vivid
dne
wily
dne
mysql-5.6
lucid
dne
precise
dne
trusty
Fixed 5.6.27-0ubuntu0.14.04.1
released
utopic
ignored
vivid
not-affected
wily
not-affected
mysql-dfsg-5.1
hardy
dne
lucid
ignored
oneiric
dne
precise
dne
quantal
dne
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
liblz4-1
suse enterprise sap 12 SP5
1.8.0-3.5.2
fixed
suse enterprise server 12 SP5
1.8.0-3.5.2
fixed
libmariadb3
suse enterprise sap 12 SP5
3.1.22-2.35.1
fixed
suse enterprise server 12 SP5
3.1.22-2.35.1
fixed
libmariadb_plugins
suse enterprise sap 12 SP5
3.1.22-2.35.1
fixed
suse enterprise server 12 SP5
3.1.22-2.35.1
fixed
libmariadbd104-devel
suse enterprise server 15 SP1
10.4.30-150100.3.5.10
fixed
libmariadbd19
suse enterprise sap 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 15 SP1
10.4.30-150100.3.5.10
fixed
libmysqlclient18
suse enterprise sap 12
10.0.16-15.1
fixed
suse enterprise sap 12 SP5
10.0.40.1-2.9.1
fixed
suse enterprise server 12
10.0.16-15.1
fixed
suse enterprise server 12 SP5
10.0.40.1-2.9.1
fixed
libmysqlclient18-32bit
suse enterprise sap 12
10.0.16-15.1
fixed
suse enterprise sap 12 SP5
10.0.40.1-2.9.1
fixed
suse enterprise server 12
10.0.16-15.1
fixed
suse enterprise server 12 SP5
10.0.40.1-2.9.1
fixed
libmysqlclient_r18
suse enterprise desktop 12
10.0.16-15.1
fixed
suse enterprise desktop 12 SP1
10.0.21-1.17
fixed
suse enterprise desktop 12 SP2
10.0.27-12.1
fixed
suse enterprise desktop 12 SP3
10.0.30-28.1
fixed
suse enterprise desktop 12 SP4
10.0.35-1.7
fixed
suse enterprise sap 12
10.0.16-15.1
fixed
suse enterprise sap 12 SP1
10.0.21-1.17
fixed
suse enterprise sap 12 SP2
10.0.27-12.1
fixed
suse enterprise sap 12 SP3
10.0.30-28.1
fixed
suse enterprise sap 12 SP4
10.0.35-1.7
fixed
suse enterprise sap 12 SP5
10.0.40.1-2.9.1
fixed
suse enterprise server 12
10.0.16-15.1
fixed
suse enterprise server 12 SP1
10.0.21-1.17
fixed
suse enterprise server 12 SP2
10.0.27-12.1
fixed
suse enterprise server 12 SP3
10.0.30-28.1
fixed
suse enterprise server 12 SP4
10.0.35-1.7
fixed
suse enterprise server 12 SP5
10.0.40.1-2.9.1
fixed
suse enterprise workstation 12
10.0.16-15.1
fixed
suse enterprise workstation 12 SP1
10.0.21-1.17
fixed
suse enterprise workstation 12 SP2
10.0.27-12.1
fixed
suse enterprise workstation 12 SP3
10.0.30-28.1
fixed
suse enterprise workstation 12 SP4
10.0.35-1.7
fixed
suse enterprise workstation 12 SP5
10.0.40.1-2.9.1
fixed
libmysqlclient_r18-32bit
suse enterprise desktop 12
10.0.16-15.1
fixed
suse enterprise desktop 12 SP1
10.0.21-1.17
fixed
suse enterprise desktop 12 SP2
10.0.27-12.1
fixed
suse enterprise desktop 12 SP3
10.0.30-28.1
fixed
suse enterprise desktop 12 SP4
10.0.35-1.7
fixed
suse enterprise sap 12
10.0.16-15.1
fixed
suse enterprise sap 12 SP1
10.0.21-1.17
fixed
suse enterprise sap 12 SP2
10.0.27-12.1
fixed
suse enterprise sap 12 SP3
10.0.30-28.1
fixed
suse enterprise sap 12 SP4
10.0.35-1.7
fixed
suse enterprise sap 12 SP5
10.0.40.1-2.9.1
fixed
suse enterprise server 12
10.0.16-15.1
fixed
suse enterprise server 12 SP1
10.0.21-1.17
fixed
suse enterprise server 12 SP2
10.0.27-12.1
fixed
suse enterprise server 12 SP3
10.0.30-28.1
fixed
suse enterprise server 12 SP4
10.0.35-1.7
fixed
suse enterprise server 12 SP5
10.0.40.1-2.9.1
fixed
suse enterprise workstation 12
10.0.16-15.1
fixed
suse enterprise workstation 12 SP1
10.0.21-1.17
fixed
suse enterprise workstation 12 SP2
10.0.27-12.1
fixed
suse enterprise workstation 12 SP3
10.0.30-28.1
fixed
suse enterprise workstation 12 SP4
10.0.35-1.7
fixed
suse enterprise workstation 12 SP5
10.0.40.1-2.9.1
fixed
libmysqld-devel
suse enterprise sap 15
10.2.15-1.3
fixed
suse enterprise sap 15 SP1
10.2.22-3.14.1
fixed
suse enterprise server 15
10.2.15-1.3
fixed
suse enterprise server 15 SP1
10.2.22-3.14.1
fixed
libmysqld19
suse enterprise sap 15
10.2.15-1.3
fixed
suse enterprise sap 15 SP1
10.2.22-3.14.1
fixed
suse enterprise server 15
10.2.15-1.3
fixed
suse enterprise server 15 SP1
10.2.22-3.14.1
fixed
mariadb
suse enterprise sap 12
10.0.16-15.1
fixed
suse enterprise sap 12 SP5
10.2.25-3.19.2
fixed
suse enterprise sap 15
10.2.15-1.3
fixed
suse enterprise sap 15 SP1
10.2.22-3.14.1
fixed
suse enterprise server 12
10.0.16-15.1
fixed
suse enterprise server 12 SP5
10.2.25-3.19.2
fixed
suse enterprise server 15
10.2.15-1.3
fixed
suse enterprise server 15 SP1
10.2.22-3.14.1
fixed
mariadb-100-errormessages
suse enterprise sap 12 SP5
10.0.40.1-2.9.1
fixed
suse enterprise server 12 SP5
10.0.40.1-2.9.1
fixed
mariadb-client
suse enterprise sap 12
10.0.16-15.1
fixed
suse enterprise sap 12 SP5
10.2.25-3.19.2
fixed
suse enterprise sap 15
10.2.15-1.3
fixed
suse enterprise sap 15 SP1
10.2.22-3.14.1
fixed
suse enterprise server 12
10.0.16-15.1
fixed
suse enterprise server 12 SP5
10.2.25-3.19.2
fixed
suse enterprise server 15
10.2.15-1.3
fixed
suse enterprise server 15 SP1
10.2.22-3.14.1
fixed
mariadb-errormessages
suse enterprise sap 12
10.0.16-15.1
fixed
suse enterprise sap 12 SP5
10.2.25-3.19.2
fixed
suse enterprise sap 15
10.2.15-1.3
fixed
suse enterprise sap 15 SP1
10.2.22-3.14.1
fixed
suse enterprise server 12
10.0.16-15.1
fixed
suse enterprise server 12 SP5
10.2.25-3.19.2
fixed
suse enterprise server 15
10.2.15-1.3
fixed
suse enterprise server 15 SP1
10.2.22-3.14.1
fixed
mariadb-tools
suse enterprise sap 12
10.0.16-15.1
fixed
suse enterprise sap 12 SP5
10.2.25-3.19.2
fixed
suse enterprise sap 15
10.2.15-1.3
fixed
suse enterprise sap 15 SP1
10.2.22-3.14.1
fixed
suse enterprise server 12
10.0.16-15.1
fixed
suse enterprise server 12 SP5
10.2.25-3.19.2
fixed
suse enterprise server 15
10.2.15-1.3
fixed
suse enterprise server 15 SP1
10.2.22-3.14.1
fixed
mariadb104
suse enterprise sap 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 15 SP1
10.4.30-150100.3.5.10
fixed
mariadb104-bench
suse enterprise sap 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 15 SP1
10.4.30-150100.3.5.10
fixed
mariadb104-client
suse enterprise sap 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 15 SP1
10.4.30-150100.3.5.10
fixed
mariadb104-errormessages
suse enterprise sap 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 15 SP1
10.4.30-150100.3.5.10
fixed
mariadb104-galera
suse enterprise sap 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 15 SP1
10.4.30-150100.3.5.10
fixed
mariadb104-rpm-macros
suse enterprise sap 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 15 SP1
10.4.30-150100.3.5.10
fixed
mariadb104-test
suse enterprise sap 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 15 SP1
10.4.30-150100.3.5.10
fixed
mariadb104-tools
suse enterprise sap 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 12 SP5
10.4.30-8.5.46
fixed
suse enterprise server 15 SP1
10.4.30-150100.3.5.10
fixed
python3-mysqlclient
suse enterprise sap 12 SP5
1.3.14-8.9.2
fixed
suse enterprise server 12 SP5
1.3.14-8.9.2
fixed
suse enterprise server 15 SP1
1.4.6-150100.3.3.7
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
mariadb
RHEL 7
1:5.5.40-1.el7_0
fixed
mariadb-bench
RHEL 7
1:5.5.40-1.el7_0
fixed
mariadb-devel
RHEL 7
1:5.5.40-1.el7_0
fixed
mariadb-embedded
RHEL 7
1:5.5.40-1.el7_0
fixed
mariadb-embedded-devel
RHEL 7
1:5.5.40-1.el7_0
fixed
mariadb-libs
RHEL 7
1:5.5.40-1.el7_0
fixed
mariadb-server
RHEL 7
1:5.5.40-1.el7_0
fixed
mariadb-test
RHEL 7
1:5.5.40-1.el7_0
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
http://seclists.org/fulldisclosure/2012/Dec/9
http://secunia.com/advisories/53372
http://security.gentoo.org/glsa/glsa-201308-06.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102
http://www.openwall.com/lists/oss-security/2012/12/02/3
http://www.openwall.com/lists/oss-security/2012/12/02/4
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
https://mariadb.atlassian.net/browse/MDEV-3909
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
http://seclists.org/fulldisclosure/2012/Dec/9
http://secunia.com/advisories/53372
http://security.gentoo.org/glsa/glsa-201308-06.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102
http://www.openwall.com/lists/oss-security/2012/12/02/3
http://www.openwall.com/lists/oss-security/2012/12/02/4
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
https://mariadb.atlassian.net/browse/MDEV-3909