PT-2013-1216 · Openssl · Polarssl

Cyril Arnaud + 1 · Published 2013-10-04 · Updated 2013-11-30 · CVE-2013-5915

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PolarSSL versions prior to 1.3.0 PolarSSL versions prior to 1.2.9

Description The issue concerns multiple vulnerabilities in the PolarSSL package, which can lead to disruption of protected information availability. These vulnerabilities can be exploited remotely. Specifically, the RSA-CRT implementation in PolarSSL does not properly perform Montgomery multiplication, potentially allowing remote attackers to conduct a timing side-channel attack and retrieve RSA private keys.

Recommendations For PolarSSL versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. For PolarSSL versions prior to 1.2.9, update to version 1.2.9 or later to address the RSA-CRT implementation vulnerability. As a temporary workaround, consider restricting access to sensitive information handled by PolarSSL until a patch is applied.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2015-09702

CVE-2013-5915

DSA-2782-1

MGASA-2013-0353

Affected Products

Polarssl

References · 20

• https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5915 · Security Note
• https://ubuntu.com/security/CVE-2013-5915 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-5915 · Vendor Advisory
• http://debian.org/security/2013/dsa-2782 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-October/118758.html · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-5915 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119018.html · Vendor Advisory
• http://secunia.com/advisories/55084 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0353 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09702 · Security Note
• https://advisories.mageia.org/MGASA-2013-0353.html · Security Note
• https://github.com/polarssl/polarssl/commit/1922a4e6aade7b1d685af19d4d9339ddb5c02859 · Note