CVE-2013-5915

CVE-2013-5915 concerns PolarSSL prior to 1.2.9, where the RSA-CRT Montgomery multiplication was not implemented securely, enabling a timing side-channel attack to potentially recover RSA private keys. Public references in connected docs show厂 PolarSSL advisories and Fedora/OpenVAS entries noting ...

CVE-2013-5915

The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys...

PT-2013-1216

Name of the Vulnerable Software and Affected Versions PolarSSL versions prior to 1.3.0 PolarSSL versions prior to 1.2.9 Description The issue concerns multiple vulnerabilities in the PolarSSL package, which can lead to disruption of protected information availability. These vulnerabilities can be...

CVE-2013-5915: Undefined Security Weakness

The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys...

FreeBSD : polarssl -- Timing attack against protected RSA-CRT implementation (ccefac3e-2aed-11e3-af10-000c29789cb5)

PolarSSL Project reports : The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount an attack on the RSA key...

polarssl -- Timing attack against protected RSA-CRT implementation

PolarSSL Project reports: The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount an attack on the RSA key...

CVE-2013-4623

The x509parsecrt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a certificate message that contains...

CVE-2013-4623

The x509parsecrt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a certificate message that contains...

UBUNTU-CVE-2013-4623

The x509parsecrt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a certificate message that contains...

Design/Logic Flaw

The x509parsecrt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a certificate message that contains...

CVE-2013-4623

The x509parsecrt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a certificate message that contains...

CVE-2013-4623

The x509parsecrt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a certificate message that contains...

CVE-2013-4623

CVE-2013-4623 concerns PolarSSL’s x509parse_crt parsing during the SSL/TLS handshake. The vulnerability affects PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8, where a certificate message containing a PEM-encoded certificate can trigger an infinite loop and high CPU usage, enabling a remote d...

CVE-2013-4623: Improper Input Validation

The x509parsecrt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a certificate message that contains...

MGASA-2013-0290 Updated polarssl package fixes security vulnerabilities

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in PolarSSL before 1.2.6, does not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and...

Updated polarssl package fixes security vulnerabilities

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in PolarSSL before 1.2.6, does not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and...

Fedora Update for polarssl FEDORA-2013-16317

Check for the Version of polarssl OpenVAS Vulnerability Test Fedora Update for polarssl FEDORA-2013-16317 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Fedora Update for polarssl FEDORA-2013-16317

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for polarssl FEDORA-2013-16356

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2013-1215

Name of the Vulnerable Software and Affected Versions PolarSSL versions 1.1.x through 1.1.6 PolarSSL versions 1.2.x through 1.2.7 PolarSSL versions prior to 1.3.0 Description The issue allows remote attackers to cause a denial of service, resulting in infinite loop and CPU consumption, by sending...