CVE-2013-1621

Description

Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session, a different vulnerability than CVE-2013-0169.

CVSS Metrics

• v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.69%• Percentile: 72%

Techniques & Countermeasures

• CWE-20•Improper Input Validation

  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected Systems

• polarssl•polarssl

  ≤ 1.2.4 | 0.10.0 | 0.10.1 | 0.11.0 | 0.11.1 | 0.12.0 | 0.12.1 | 0.13.1 | 0.14.0 | 0.14.2 | 0.14.3 | 0.99:pre1 | 0.99:pre3 | 0.99:pre4 | 0.99:pre5 | 1.0.0 | 1.1.0 | 1.1.0:rc0 | 1.1.0:rc1 | 1.1.1 | 1.1.2 | 1.1.3 | 1.1.4 | 1.1.5 | 1.2.0 | 1.2.1 | 1.2.2 | 1.2.3

References (4)

• http://www.isg.rhul.ac.uk/tls/TLStiming.pdf
• http://www.debian.org/security/2013/dsa-2622
• http://openwall.com/lists/oss-security/2013/02/05/24
• https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released