PT-2013-1215

Name of the Vulnerable Software and Affected Versions PolarSSL versions 1.1.x through 1.1.6 PolarSSL versions 1.2.x through 1.2.7 PolarSSL versions prior to 1.3.0 Description The issue allows remote attackers to cause a denial of service, resulting in infinite loop and CPU consumption, by sending...

[SECURITY] Fedora 20 Update: polarssl-1.2.8-1.fc20

PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

Fedora 20 : polarssl-1.2.8-1.fc20 (2013-16258)

PolarSSL 1.2.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

Fedora 19 : polarssl-1.2.8-1.fc19 (2013-16317)

PolarSSL 1.2.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

Fedora 18 : polarssl-1.2.8-1.fc18 (2013-16356)

PolarSSL 1.2.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

[SECURITY] Fedora 18 Update: polarssl-1.2.8-1.fc18

PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

[SECURITY] Fedora 19 Update: polarssl-1.2.8-1.fc19

PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

FreeBSD : polarssl -- denial of service vulnerability (72bf9e21-03df-11e3-bd8d-080027ef73ec)

Paul Bakker reports : A bug in the logic of the parsing of PEM encoded certificates in x509parsecrt can result in an infinite loop, thus hogging processing power. While parsing a Certificate message during the SSL/TLS handshake, PolarSSL extracts the presented certificates and sends them on to be...

polarssl -- denial of service vulnerability

Paul Bakker reports: A bug in the logic of the parsing of PEM encoded certificates in x509parsecrt can result in an infinite loop, thus hogging processing power. While parsing a Certificate message during the SSL/TLS handshake, PolarSSL extracts the presented certificates and sends them on to be...

[ MDVSA-2013:167 ] openvpn

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:167 http://www.mandriva.com/en/support/security/ Package : openvpn Date : May 27, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated openvpn package fixes security...

Mandriva Linux Security Advisory : openvpn (MDVSA-2013:167)

Updated openvpn package fixes security vulnerability : OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function. Plaintext recovery may be possible using a padding oracle attack on the CBC mode cipher implementati...

OpenSSL / PolarSSL / GnuTLS security vulnerabilities

Timing attacks, DoS...

[SECURITY] [DSA 2622-1] polarssl security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2622-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst February 13, 2013 http://www.debian.org/security/faq -...

Debian DSA-2622-1 : polarssl - several vulnerabilities

Multiple vulnerabilities have been found in PolarSSL. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2013-0169 A timing side channel attack has been found in CBC padding allowing an attacker to recover pieces of plaintext via statistical analysis of craft...

[SECURITY] [DSA 2622-1] polarssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2622-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst February 13, 2013 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2622-1 (polarssl - several vulnerabilities)

Multiple vulnerabilities have been found in PolarSSL. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2013-0169A timing side channel attack has been found in CBC padding allowing an attacker to recover pieces of plaintext via statistical analysis of crafted...

DSA-2622-1 polarssl - several

Bulletin has no description...

Debian: Security Advisory (DSA-2622-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-0169

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct...

CVE-2013-0169

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct...