Trustwave SpiderLabs Security Advisory TWSL2015-014: Account Probing Vulnerability in Oracle Database Published: 07/15/15 Version: 1.0 Vendor: Oracle (www.oracle.com) Product: Oracle Database 12c Version affected: 12.1.0.2 Product description: Relational database management system for UNIX, Linux, and Microsoft Windows platforms. Finding 1: Account Probing Vulnerability Credit: Martin Rakhmanov of Trustwave CVE: CVE-2015-4755 Oracle Database 12.1.0.2 sends different responses to clients depending on account existence. This allows attackers verify if specific account exists or not without knowing its password. Example 1: Probing usernames Attacker using sqlplus application from 12.1.0.2 tries to login with given username and arbitrary password. The server will send a packet containing AUTH_VFR_DATA among others packets in response: -- Example server packet capture 39 39 39 00 00 00 00 0D-00 00 00 0D 41 55 54 48 999.........AUTH 5F 56 46 52 5F 44 41 54-41 20 00 00 00 20 38 44 _VFR_DATA.....8D 44 31 42 45 33 46 36 37-42 46 46 39 38 31 33 41 D1BE3F67BFF9813A 34 36 34 33 38 32 33 38-31 41 42 33 36 42 15 48 464382381AB36B.H For existing accounts AUTH_VFR_DATA will be followed by 32 characters. For non-existing accounts this value will be followed by 20 characters. Revision History: 05/21/15 - Vulnerability disclosed to vendor 07/14/15 - Fix released by vendor 07/15/15 - Advisory published References 1. http://www.oracle.com/technetwork/topics/security/cpujul2015verbose-2367947.html About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risks. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs while safely embracing business imperatives including big data, BYOD and social media. More than 2.5 million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective data protection, risk management and threat intelligence. Trustwave is a privately held company, headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.