PT-2013-1216 · Openssl · Polarssl

Cyril Arnaud + 1 · Publicado 2013-10-04 · Atualizado 2013-11-30 · CVE-2013-5915

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PolarSSL versions prior to 1.3.0 PolarSSL versions prior to 1.2.9

Description The issue concerns multiple vulnerabilities in the PolarSSL package, which can lead to disruption of protected information availability. These vulnerabilities can be exploited remotely. Specifically, the RSA-CRT implementation in PolarSSL does not properly perform Montgomery multiplication, potentially allowing remote attackers to conduct a timing side-channel attack and retrieve RSA private keys.

Recommendations For PolarSSL versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. For PolarSSL versions prior to 1.2.9, update to version 1.2.9 or later to address the RSA-CRT implementation vulnerability. As a temporary workaround, consider restricting access to sensitive information handled by PolarSSL until a patch is applied.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

BDU:2015-09702

CVE-2013-5915

DSA-2782-1

MGASA-2013-0353

Produtos afetados

Polarssl

Referências · 20

• https://github.com/polarssl/polarssl/commit/1922a4e6aade7b1d685af19d4d9339ddb5c02859 · Nota
• https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05 · Aviso do Fabricante
• http://securityfocus.com/bid/62771 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5915 · Nota de Segurança
• https://ubuntu.com/security/CVE-2013-5915 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201310-10.xml · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-5915 · Aviso do Fabricante
• http://debian.org/security/2013/dsa-2782 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html · Aviso do Fabricante
• https://moxa.com/en/support/product-support/security-advisory/edr-810-series-security-router-vulnerabilities-(1) · Nota
• http://osvdb.org/98049 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2013-October/118758.html · Aviso do Fabricante
• https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2013-5915 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119018.html · Aviso do Fabricante