MGASA-2013-0290: polarssl Mageia

Vulnerability summary

MGASA-2013-0290 is a vulnerability in polarssl Mageia with no CVSS score yet.

Timeline

1. 24-09-2013
   PublishedVulnerability first disclosed.
2. 16-04-2026
   Last modifiedVulnerability information updated.

Description

Updated polarssl package fixes security vulnerabilities The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in PolarSSL before 1.2.6, does not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue (CVE-2013-0169). Array index error in the SSL module in PolarSSL before 1.2.6 might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session (CVE-2013-1621). A third party can set up a SSL/TLS handshake with a server and send a malformed Certificate handshake message that results in an infinite loop for that connection. With a Man-in-the-Middle attack on a client, a third party can trigger the same infinite loop on a client (CVE-2013-4623).

No weakness data has been published for this record.