NVD

Id
37798  
Name
CVE-2013-1619  
Description
The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-18  
Published
2013-02-08  
Modified Date
2014-03-26  
Seq
2013-1619  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
192445 37798 CVE-2013-1619 SUSE-SU-2014:0320  View
192446 37798 CVE-2013-1619 SUSE-SU-2014:0322  View
192447 37798 CVE-2013-1619 openSUSE-SU-2014:0346  View
192448 37798 CVE-2013-1619 openSUSE-SU-2013:0807  View
192449 37798 CVE-2013-1619 http://nmav.gnutls.org/2013/02/time-is-money-for-cbc-ciphersuites.html  View
192450 37798 CVE-2013-1619 [oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations  View
192451 37798 CVE-2013-1619 RHSA-2013:0588  View
192452 37798 CVE-2013-1619 http://www.gnutls.org/security.html#GNUTLS-SA-2013-1  View
192453 37798 CVE-2013-1619 http://www.isg.rhul.ac.uk/tls/TLStiming.pdf  View
192454 37798 CVE-2013-1619 USN-1752-1  View
192455 37798 CVE-2013-1619 https://gitorious.org/gnutls/gnutls/commit/328ee22c1b3951e060c7124c7cb1cee592c59bc0  View
192456 37798 CVE-2013-1619 https://gitorious.org/gnutls/gnutls/commit/b8391806cd79095fe566f2401d8c7ad85a64b198  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19887 JVNDB-2013-001462 GnuTLS の TLS の実装における識別攻撃およびプレーンテキストリカバリ攻撃を誘発される脆弱性 GnuTLS の TLS の実装は、不正な形式の CBC パディングを処理している間、非準拠の MAC チェック操作へのタイミングサイドチャネル攻撃について適切に配慮しないため、識別攻撃、およびプレーンテキストリカバリ攻撃を誘発される脆弱性が存在します。 CVE-2013-1619 61561 CVE-2013-1619 37798 4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001462.html 2013-02-08 2013-10-31 View