CVE-2012-0390

Description

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.

CVSS Metrics

• v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.26%• Percentile: 50%

Techniques & Countermeasures

• CWE-310•Cryptographic Issues

  Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Affected Systems

• gnu•gnutls

  ≤ 3.0.10 | 2.2.4 | 2.2.5 | 2.4.0 | 2.4.1 | 2.4.2 | 2.4.3 | 2.6.0 | 2.6.1 | 2.6.2 | 2.6.3 | 2.6.4 | 2.6.5 | 2.6.6 | 2.8.0 | 2.8.1 | 2.8.2 | 2.8.3 | 2.8.4 | 2.8.5 | 2.8.6 | 2.10.0 | 2.10.1 | 2.10.1-x86 | 2.10.2 | 2.10.2-x86 | 2.10.3 | 2.10.4 | 2.10.5 | 2.10.5-x86 | 2.12.0 | 2.12.1 | 2.12.2 | 2.12.3 | 2.12.4 | 2.12.5 | 2.12.6 | 2.12.6.1 | 2.12.7 | 2.12.8 | 2.12.9 | 2.12.10 | 2.12.11 | 2.12.12 | 2.12.13 | 2.12.14 | 3.0.0 | 3.0.1 | 3.0.2 | 3.0.3 | 3.0.4 | 3.0.5 | 3.0.6 | 3.0.7 | 3.0.8 | 3.0.9

References (3)

• http://secunia.com/advisories/57260
• http://www.isg.rhul.ac.uk/~kp/dtls.pdf
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html