PT-2013-3284 · Wolfssl · Cyassl

Publicado 2013-02-08 · Atualizado 2014-02-21 · CVE-2013-1623

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CyaSSL versions prior to 2.5.0

Description The issue is related to the TLS and DTLS implementations not properly considering timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding. This allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets.

Recommendations For versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-1623

DSA-2780-1

Produtos afetados

Cyassl

Referências · 6

• http://openwall.com/lists/oss-security/2013/02/05/24 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-1623 · Nota de Segurança
• http://secunia.com/advisories/53372 · Nota
• http://isg.rhul.ac.uk/tls/TLStiming.pdf · Nota
• http://yassl.com/yaSSL/Blog/Entries/2013/2/5_WolfSSL%2C_provider_of_CyaSSL_Embedded_SSL%2C_releases_first_embedded_TLS_and_DTLS_protocol_fix_for_Lucky_Thirteen_Attack.html · Nota
• http://security.gentoo.org/glsa/glsa-201308-06.xml · Aviso do Fabricante