I have a scheme that, long story short, uses AES in CBC mode to encrypt third-party credentials for user accounts with a password-derived key. It's been mentioned that the use of CBC mode is a vulnerability because it is susceptible to "padding oracle attacks"; the cipher, after being initialized by the legitimate user with the proper key/IV, can be used by an attacker to execute a chosen-ciphertext attack to recover the plaintext without ever discovering the key.
The question is, do I actually have to worry about this type of attack given the way my system uses the cipher, specifically the fact that the cipher instance is only in existence for some seconds before its internal state is erased and it goes out of scope?
Perhaps more background is necessary. The basic scheme is that the user enters their username and password. The password is "stretched" by hashing it with SHA-512, and then that digest is split in half; one side is BCrypted for password verification by the server, the other half is the AES key used to decrypt the user credentials retrieved from the server.
So, the AES cipher isn't being used to maintain an open secure channel with a remote party; it's created, initialized, does its job on one message, and is then cleaned, disposed and garbage collected. This takes less than a second. To my way of thinking, this would make a POA infeasible, because the attacker would need an open, initialized instance of the cipher to bounce his chosen ciphertexts off of, which would take far longer than the second or two that the cipher instance is doing its job. Further, the cipher instance isn't being exposed to anyone outside the computer; if an attacker's in the computer, he has the user's password plain and simple, but an attacker can't even make a network request of the client computer that would involve the cipher in any way.
There are much easier attacks on this scheme as implemented, perhaps the simplest being that the AES key is derived rather simply from a user-chosen password (and we know how much entropy those have).
So, should I worry about the vulnerability of CBC mode to padding oracle attacks in my specific circumstance, or am I reasonably safe from that particular vector and should concentrate on other areas of weakness?