CVE-2013-5915

CVE-2013-5915 concerns PolarSSL prior to 1.2.9, where the RSA-CRT Montgomery multiplication was not implemented securely, enabling a timing side-channel attack to potentially recover RSA private keys. Public references in connected docs show厂 PolarSSL advisories and Fedora/OpenVAS entries noting ...

CVE-2013-5915: Undefined Security Weakness

The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys...

MGASA-2013-0290 Updated polarssl package fixes security vulnerabilities

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in PolarSSL before 1.2.6, does not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and...

Authentication flaw

The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack...

CVE-2013-4165

CVE-2013-4165 affects bitcoind 0.8.1, where the HTTPAuthorized function in bitcoinrpc.cpp leaks timing information on the first incorrect password byte, enabling remote attackers to guess passwords via a timing side-channel. Impact: authenticated RPC password guessing vulnerability. Remediation: ...

CVE-2013-4165

The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack...

Mandriva Linux Security Advisory : tor (MDVSA-2013:132)

Updated tor package fixes security vulnerabilities : Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the se...

Ubuntu Update for openssl USN-1732-3

Check for the Version of openssl OpenVAS Vulnerability Test $Id: gbubuntuUSN17323.nasl 7958 2017-12-01 06:47:47Z santu $ Ubuntu Update for openssl USN-1732-3 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software...

Ubuntu 12.04 LTS / 12.10 : openssl vulnerability (USN-1732-3)

USN-1732-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2013-0169 and CVE-2012-2686 was reverted in USN-1732-2 because of a regression. This update restores the security fix, and includes an extra fix from upstream to address the AES-NI regression. We apologize for the inconvenience. Adam...

USN-1732-3: OpenSSL vulnerability

USN-1732-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2013-0169 and CVE-2012-2686 was reverted in USN-1732-2 because of a regression. This update restores the security fix, and includes an extra fix from upstream to address the AES-NI regression. We apologize for the inconvenience. Origina...

[USN-1763-1] NSS vulnerability

========================================================================== Ubuntu Security Notice USN-1763-1 March 14, 2013 nss vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : nss vulnerability (USN-1763-1)

Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used in NSS was vulnerable to a timing side-channel attack known as the 'Lucky Thirteen' issue. A remote attacker could use this issue to perform plaintext-recovery attacks via analysis of timing data. Note that Tenable Networ...

Ubuntu: Security Advisory (USN-1763-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for nss USN-1763-1

Check for the Version of nss OpenVAS Vulnerability Test $Id: gbubuntuUSN17631.nasl 7958 2017-12-01 06:47:47Z santu $ Ubuntu Update for nss USN-1763-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you ca...

USN-1763-2: NSPR update

USN-1763-1 fixed a vulnerability in NSS. This update provides the NSPR needed to use the new NSS. Original advisory details: Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used in NSS was vulnerable to a timing side-channel attack known as the "Lucky Thirteen" issue. A...

USN-1763-1: NSS vulnerability

Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used in NSS was vulnerable to a timing side-channel attack known as the "Lucky Thirteen" issue. A remote attacker could use this issue to perform plaintext-recovery attacks via analysis of timing data...

Ubuntu: Security Advisory (USN-1752-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for gnutls26 USN-1752-1

Check for the Version of gnutls26 OpenVAS Vulnerability Test $Id: gbubuntuUSN17521.nasl 8494 2018-01-23 06:57:55Z teissa $ Ubuntu Update for gnutls26 USN-1752-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

Ubuntu Update for openssl USN-1732-1

Check for the Version of openssl OpenVAS Vulnerability Test $Id: gbubuntuUSN17321.nasl 8650 2018-02-03 12:16:59Z teissa $ Ubuntu Update for openssl USN-1732-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free softwar...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : openjdk-6, openjdk-7 vulnerabilities (USN-1735-1)

Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used in OpenJDK was vulnerable to a timing side-channel attack known as the 'Lucky Thirteen' issue. A remote attacker could use this issue to perform plaintext-recovery attacks via analysis of timing data. CVE-2013-0169 A...