NVD

Id
38173  
Name
CVE-2013-2061  
Description
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2013-11-17  
Modified Date
2014-01-03  
Seq
2013-2061  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
195136 38173 CVE-2013-2061 FEDORA-2013-7552  View
195137 38173 CVE-2013-2061 FEDORA-2013-7531  View
195138 38173 CVE-2013-2061 openSUSE-SU-2013:1645  View
195139 38173 CVE-2013-2061 openSUSE-SU-2013:1649  View
195140 38173 CVE-2013-2061 MDVSA-2013:167  View
195141 38173 CVE-2013-2061 [oss-security] 20130506 Re: CVE request: OpenVPN use of non-constant-time memcmp in HMAC comparison in openvpn_decrypt  View
195142 38173 CVE-2013-2061 https://bugs.gentoo.org/show_bug.cgi?id=468756  View
195143 38173 CVE-2013-2061 https://bugzilla.redhat.com/show_bug.cgi?id=960192  View
195144 38173 CVE-2013-2061 https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc  View
195145 38173 CVE-2013-2061 https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
23559 JVNDB-2013-005134 OpenVPN の crypto.c の openvpn_decrypt 関数における重要な情報を取得される脆弱性 OpenVPN の crypto.c の openvpn_decrypt 関数には、UDP モードで実行されている場合、重要な情報を取得される脆弱性が存在します。 CVE-2013-2061 62003 CVE-2013-2061 38173 2.6 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005134.html 2013-03-22 2013-11-28 View