PT-2013-3281 · Opera · Opera

Publicado 2013-02-08 · Atualizado 2013-03-08 · CVE-2013-1618

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Opera versions prior to 12.13

Description The issue is related to the TLS implementation, which does not properly consider timing side-channel attacks on a MAC check operation during the processing of malformed CBC padding. This allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets.

Recommendations For Opera versions prior to 12.13, update to version 12.13 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-1618

Produtos afetados

Opera

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-1618 · Nota de Segurança
• http://openwall.com/lists/oss-security/2013/02/05/24 · Nota
• http://isg.rhul.ac.uk/tls/TLStiming.pdf · Nota
• http://opera.com/support/kb/view/1044 · Aviso do Fabricante
• http://opera.com/docs/changelogs/unified/1213 · Nota
• http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html · Aviso do Fabricante