PT-2013-3284 · Wolfssl · Cyassl

Published 2013-02-08 · Updated 2014-02-21 · CVE-2013-1623

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CyaSSL versions prior to 2.5.0

Description The issue is related to the TLS and DTLS implementations not properly considering timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding. This allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets.

Recommendations For versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-1623

DSA-2780-1

Affected Products

Cyassl

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-1623 · Security Note
• http://security.gentoo.org/glsa/glsa-201308-06.xml · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/02/05/24 · Note
• http://secunia.com/advisories/53372 · Note
• http://isg.rhul.ac.uk/tls/TLStiming.pdf · Note
• http://yassl.com/yaSSL/Blog/Entries/2013/2/5_WolfSSL%2C_provider_of_CyaSSL_Embedded_SSL%2C_releases_first_embedded_TLS_and_DTLS_protocol_fix_for_Lucky_Thirteen_Attack.html · Note