PT-2013-3281 · Opera · Opera

Published 2013-02-08 · Updated 2013-03-08 · CVE-2013-1618

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Opera versions prior to 12.13

Description The issue is related to the TLS implementation, which does not properly consider timing side-channel attacks on a MAC check operation during the processing of malformed CBC padding. This allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets.

Recommendations For Opera versions prior to 12.13, update to version 12.13 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-1618

Affected Products

Opera

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-1618 · Security Note
• http://opera.com/support/kb/view/1044 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/02/05/24 · Note
• http://isg.rhul.ac.uk/tls/TLStiming.pdf · Note
• http://opera.com/docs/changelogs/unified/1213 · Note