CVE-2013-1620

Mozilla Network Security Services - Timing Side-Channel Attack via CBC Padding

Title source: llm

Description

The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

References (19)

Core 19

Core References

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/57777

Third Party Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1763-1

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/64758

Technical Description, Third Party Advisory x_refsource_misc

http://www.isg.rhul.ac.uk/tls/TLStiming.pdf

Broken Link vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://openwall.com/lists/oss-security/2013/02/05/24

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-201406-19.xml

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-1135.html

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-1144.html

Third Party Advisory x_refsource_confirm

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2014/Dec/23

Broken Link vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

Scores

EPSS 0.0372

EPSS Percentile 88.4%

Details

CWE

CWE-203

Status published

Products (25)

canonical/ubuntu_linux 10.04

canonical/ubuntu_linux 11.10

canonical/ubuntu_linux 12.04

canonical/ubuntu_linux 12.10

mozilla/network_security_services < 3.14.3

oracle/enterprise_manager_ops_center 11.1

oracle/enterprise_manager_ops_center 12.1

oracle/enterprise_manager_ops_center 12.2

oracle/glassfish_communications_server 2.0

oracle/glassfish_server 2.1.1

... and 15 more

Published Feb 08, 2013

Tracked Since Feb 18, 2026