The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
21 Nov 2024, 01:50
Type | Values Removed | Values Added |
---|---|---|
References | () http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 - Third Party Advisory | |
References | () http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html - Broken Link | |
References | () http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html - Broken Link | |
References | () http://openwall.com/lists/oss-security/2013/02/05/24 - Mailing List, Third Party Advisory | |
References | () http://rhn.redhat.com/errata/RHSA-2013-1135.html - Third Party Advisory | |
References | () http://rhn.redhat.com/errata/RHSA-2013-1144.html - Third Party Advisory | |
References | () http://seclists.org/fulldisclosure/2014/Dec/23 - Mailing List, Third Party Advisory | |
References | () http://security.gentoo.org/glsa/glsa-201406-19.xml - Third Party Advisory | |
References | () http://www.isg.rhul.ac.uk/tls/TLStiming.pdf - Technical Description, Third Party Advisory | |
References | () http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html - Third Party Advisory | |
References | () http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html - Third Party Advisory | |
References | () http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html - Third Party Advisory | |
References | () http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - Third Party Advisory | |
References | () http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - Third Party Advisory | |
References | () http://www.securityfocus.com/archive/1/534161/100/0/threaded - Third Party Advisory, VDB Entry | |
References | () http://www.securityfocus.com/bid/57777 - Third Party Advisory, VDB Entry | |
References | () http://www.securityfocus.com/bid/64758 - Third Party Advisory, VDB Entry | |
References | () http://www.ubuntu.com/usn/USN-1763-1 - Third Party Advisory | |
References | () http://www.vmware.com/security/advisories/VMSA-2014-0012.html - Third Party Advisory |
Information
Published : 2013-02-08 19:55
Updated : 2024-11-21 01:50
NVD link : CVE-2013-1620
Mitre link : CVE-2013-1620
CVE.ORG link : CVE-2013-1620
JSON object : View
Products Affected
oracle
- vm_server
- opensso
- enterprise_manager_ops_center
- glassfish_server
- traffic_director
- iplanet_web_server
- iplanet_web_proxy_server
- glassfish_communications_server
redhat
- enterprise_linux_server
- enterprise_linux_desktop
- enterprise_linux_server_aus
- enterprise_linux_eus
- enterprise_linux_workstation
canonical
- ubuntu_linux
mozilla
- network_security_services
CWE
CWE-203
Observable Discrepancy