Design/Logic Flaw

2013-02-0819:55:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

69.4%

JSON

The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

CPENameOperatorVersion
ubuntu_linuxeq11.10
ubuntu_linuxeq12.10
ubuntu_linuxeq10.04
ubuntu_linuxeq12.04
network_security_serviceslt3.14.3
enterprise_manager_ops_centereq12.1
enterprise_manager_ops_centereq12.2
enterprise_manager_ops_centereq11.1
glassfish_communications_servereq2.0
glassfish_servereq2.1.1

Name	Operator	Version
ubuntu_linux	eq	11.10
ubuntu_linux	eq	12.10
ubuntu_linux	eq	10.04
ubuntu_linux	eq	12.04
network_security_services	lt	3.14.3
enterprise_manager_ops_center	eq	12.1
enterprise_manager_ops_center	eq	12.2
enterprise_manager_ops_center	eq	11.1
glassfish_communications_server	eq	2.0
glassfish_server	eq	2.1.1