PT-2013-3282 · Oracle+5 · Oracle Vm Server+16

Kenny Paterson + 1 · Published 2013-02-08 · Updated 2024-06-15 · CVE-2013-1620

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services (NSS) (affected versions not specified) Canonical Ubuntu Linux (affected versions not specified) Oracle Enterprise Manager Ops Center (affected versions not specified) Oracle GlassFish Communications Server (affected versions not specified) Oracle GlassFish Server (affected versions not specified) Oracle iPlanet Web Proxy Server (affected versions not specified) Oracle iPlanet Web Server (affected versions not specified) Oracle OpenSSO (affected versions not specified) Oracle Traffic Director (affected versions not specified) Oracle VM Server (affected versions not specified) Red Hat Enterprise Linux Desktop (affected versions not specified) Red Hat Enterprise Linux EUS (affected versions not specified) Red Hat Enterprise Linux Server (affected versions not specified) Red Hat Enterprise Linux Server AUS (affected versions not specified) Red Hat Enterprise Linux Workstation (affected versions not specified)

Description The TLS implementation in Mozilla Network Security Services (NSS) is susceptible to timing side-channel attacks due to improper handling of noncompliant MAC check operations during the processing of malformed CBC padding. This allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CESA-2013_1144

CVE-2013-1620

OPENSUSE-SU-2013_0630-1

OPENSUSE-SU-2024:10451-1

RHSA-2013:1135

RHSA-2013:1144

RHSA-2013:1181

RHSA-2013_1135

RHSA-2013_1144

Affected Products

Centos

Network Security Services

Oracle Enterprise Manager Ops Center

Oracle Glassfish Communications Server

Oracle Glassfish Server

Oracle Opensso

Oracle Traffic Director

Oracle Vm Server

Oracle Iplanet Web Proxy Server

Oracle Iplanet Web Server

Red Hat

Red Hat Enterprise Linux Desktop

Red Hat Enterprise Linux

Red Hat Enterprise Linux Server

Red Hat Enterprise Linux Workstation

Suse

Ubuntu

References · 74

• https://security-tracker.debian.org/tracker/CVE-2013-1620 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1763-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1620 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0791 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10451-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201406-19.xml · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-1144.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1620 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1620 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1620 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1144.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1135.html · Vendor Advisory
• http://support.novell.com/security/cve/CVE-2013-0789.html · Note