CVE-2013-0169

2013-02-0800:00:00

ubuntu.com

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

0.005 Low

EPSS

Percentile

76.9%

JSON

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in
OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider
timing side-channel attacks on a MAC check requirement during the
processing of malformed CBC padding, which allows remote attackers to
conduct distinguishing attacks and plaintext-recovery attacks via
statistical analysis of timing data for crafted packets, aka the “Lucky
Thirteen” issue.

Bugs

Notes

Author	Note
jdstrand	1.0.1d has incorrect fix. Use 1.0.1e:
mdeslaur	regression bug: http://rt.openssl.org/Ticket/Display.html?id=2975&user=guest&pass=guest 1.0.1e still contains another regression: another regression: http://rt.openssl.org/Ticket/Display.html?id=2984&user=guest&pass=guest OpenSSL fix reverted by 1732-2 because of regression (see: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1133333) (see: http://rt.openssl.org/Ticket/Display.html?id=3002) (see: bugs.debian.org/cgi-bin/bugreport.cgi?bug=701868)

Author

Note

jdstrand

1.0.1d has incorrect fix. Use 1.0.1e:

mdeslaur

regression bug: http://rt.openssl.org/Ticket/Display.html?id=2975&user=guest&pass=guest 1.0.1e still contains another regression: another regression: http://rt.openssl.org/Ticket/Display.html?id=2984&user=guest&pass=guest OpenSSL fix reverted by 1732-2 because of regression (see: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1133333) (see: http://rt.openssl.org/Ticket/Display.html?id=3002) (see: bugs.debian.org/cgi-bin/bugreport.cgi?bug=701868)

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchopenjdk-6< 6b27-1.12.3-0ubuntu1~08.04.1UNKNOWN
ubuntu10.04noarchopenjdk-6< 6b27-1.12.3-0ubuntu1~10.04UNKNOWN
ubuntu11.10noarchopenjdk-6< 6b27-1.12.3-0ubuntu1~11.10UNKNOWN
ubuntu12.04noarchopenjdk-6< 6b27-1.12.3-0ubuntu1~12.04UNKNOWN
ubuntu12.10noarchopenjdk-6< 6b27-1.12.3-0ubuntu1~12.10UNKNOWN
ubuntu13.04noarchopenjdk-6< 6b27-1.12.3-1ubuntu1UNKNOWN
ubuntu13.10noarchopenjdk-6< 6b27-1.12.3-1ubuntu1UNKNOWN
ubuntu14.04noarchopenjdk-6< 6b27-1.12.3-1ubuntu1UNKNOWN
ubuntu11.10noarchopenjdk-7< 7u15-2.3.7-0ubuntu1~11.10UNKNOWN
ubuntu12.04noarchopenjdk-7< 7u15-2.3.7-0ubuntu1~12.04UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	openjdk-6	< 6b27-1.12.3-0ubuntu1~08.04.1	UNKNOWN
ubuntu	10.04	noarch	openjdk-6	< 6b27-1.12.3-0ubuntu1~10.04	UNKNOWN
ubuntu	11.10	noarch	openjdk-6	< 6b27-1.12.3-0ubuntu1~11.10	UNKNOWN
ubuntu	12.04	noarch	openjdk-6	< 6b27-1.12.3-0ubuntu1~12.04	UNKNOWN
ubuntu	12.10	noarch	openjdk-6	< 6b27-1.12.3-0ubuntu1~12.10	UNKNOWN
ubuntu	13.04	noarch	openjdk-6	< 6b27-1.12.3-1ubuntu1	UNKNOWN
ubuntu	13.10	noarch	openjdk-6	< 6b27-1.12.3-1ubuntu1	UNKNOWN
ubuntu	14.04	noarch	openjdk-6	< 6b27-1.12.3-1ubuntu1	UNKNOWN
ubuntu	11.10	noarch	openjdk-7	< 7u15-2.3.7-0ubuntu1~11.10	UNKNOWN
ubuntu	12.04	noarch	openjdk-7	< 7u15-2.3.7-0ubuntu1~12.04	UNKNOWN