Back to feed
EUVD-2013-1655 · Published Feb 8, 2013
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Technologies
Redhat Enterprise Linux Server AusOracle Glassfish ServerMozilla Network Security ServicesOracle Iplanet Web ServerOracle Traffic DirectorRedhat Enterprise Linux EusOracle OpenssoOracle Glassfish Communications ServerOracle Iplanet Web Proxy ServerRedhat Enterprise Linux ServerOracle Vm ServerRedhat Enterprise Linux DesktopRedhat Enterprise Linux WorkstationCanonical Ubuntu LinuxOracle Enterprise Manager Ops Center
Weaknesses
CWE-203
CVSS scores
- v2.04.3
AV:N/AC:M/Au:N/C:P/I:N/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html
- http://openwall.com/lists/oss-security/2013/02/05/24
- http://rhn.redhat.com/errata/RHSA-2013-1135.html
- http://rhn.redhat.com/errata/RHSA-2013-1144.html
Potentially impacted assets
See if this affects your attack surface
