NVD

Id
37802  
Name
CVE-2013-1623  
Description
The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2013-02-08  
Modified Date
2014-02-20  
Seq
2013-1623  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
192480 37802 CVE-2013-1623 [oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations  View
192481 37802 CVE-2013-1623 GLSA-201308-06  View
192482 37802 CVE-2013-1623 http://www.isg.rhul.ac.uk/tls/TLStiming.pdf  View
192483 37802 CVE-2013-1623 http://www.yassl.com/yaSSL/Blog/Entries/2013/2/5_WolfSSL%2C_provider_of_CyaSSL_Embedded_SSL%2C_releases_first_embedded_TLS_and_DTLS_protocol_fix_for_Lucky_Thirteen_Attack.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19891 JVNDB-2013-001466 wolfSSL CyaSSL における識別攻撃およびプレーンテキストリカバリ攻撃を誘発される脆弱性 wolfSSL CyaSSL の TLS および DTLS の実装は、不正な形式の CBC パディングを処理している間、非準拠の MAC チェック操作へのタイミングサイドチャネル攻撃について適切に配慮しないため、識別攻撃、およびプレーンテキストリカバリ攻撃を誘発される脆弱性が存在します。 CVE-2013-1623 61565 CVE-2013-1623 37802 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001466.html 2013-02-05 2013-11-08 View