Action not permitted
Modal body text goes here.
icsa-19-192-04
Vulnerability from csaf_cisa
Published
2019-07-11 00:00
Modified
2019-07-11 00:00
Summary
Siemens SIMATIC RF6XXR
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities could allow access to sensitive information.
Critical infrastructure sectors
Critical Manufacturing, Food and Agriculture, Transportation Systems
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Recommended Practices
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and
solutions, please contact the Siemens ProductCERT:
https://www.siemens.com/cert/advisories
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Exploitability
High skill level is needed to exploit.
{ "document": { "acknowledgments": [ { "names": [ "Wendy Parrington" ], "organization": "United Utilities", "summary": "reporting these vulnerabilities to Siemens" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of these vulnerabilities could allow access to sensitive information.", "title": "Risk evaluation" }, { "category": "other", "text": "Critical Manufacturing, Food and Agriculture, Transportation Systems", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:", "title": "Recommended Practices" }, { "category": "general", "text": "NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nNCCIC also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and \nsolutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "other", "text": "High skill level is needed to exploit.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "ICS Advisory ICSA-19-192-04 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2019/icsa-19-192-04.json" }, { "category": "self", "summary": "ICS Advisory ICSA-19-192-04 Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-192-04" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.us-cert.gov/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B" }, { "category": "external", "summary": "SSA-496604: SSA-556833: TLS Vulnerabilities in SIMATIC RF6XXR - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/SSA-556833.txt" } ], "title": "Siemens SIMATIC RF6XXR", "tracking": { "current_release_date": "2019-07-11T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-19-192-04", "initial_release_date": "2019-07-11T00:00:00.000000Z", "revision_history": [ { "date": "2019-07-11T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "ICSA-19-192-04 Siemens SIMATIC RF6XXR " } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "All versions \u003c V3.2.1", "product": { "name": "SIMATIC RF615R: All versions \u003c V3.2.1", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "SIMATIC RF615R" }, { "branches": [ { "category": "product_version_range", "name": "All versions \u003c V3.2.1", "product": { "name": "SIMATIC RF68XR: All versions \u003c V3.2.1", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "SIMATIC RF68XR" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2011-3389", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The SSL protocol encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses e.g. the HTML5 WebSocket API, the Java URLConnection API, or the Silverlight WebClient API, aka a \"BEAST\" attack.", "title": "Summary" }, { "category": "summary", "text": "The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality of the device.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "https://support.industry.siemens.com/cs/ww/en/view/109768501", "url": "https://support.industry.siemens.com/cs/ww/en/view/109768501" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3389" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "vendor_fix", "details": "Restrict network access to the device to the extent possible", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "Update to V3.2.1 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768501 ", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109768501" }, { "category": "vendor_fix", "details": "Update to V3.2.1 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768501 ", "product_ids": [ "CSAFPID-0002" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109768501" }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2016-6329", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "TLS, when used with a 64-bit block cipher, could allow remote attackers to obtain cleartext data by leveraging a birthday attack against a long-duration encrypted session, aka a \"Sweet32\" attack.", "title": "Summary" }, { "category": "summary", "text": "The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality of the device.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "https://support.industry.siemens.com/cs/ww/en/view/109768501", "url": "https://support.industry.siemens.com/cs/ww/en/view/109768501" } ], "remediations": [ { "category": "vendor_fix", "details": "Restrict network access to the device to the extent possible", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "Update to V3.2.1 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768501 ", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109768501" }, { "category": "vendor_fix", "details": "Update to V3.2.1 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768501 ", "product_ids": [ "CSAFPID-0002" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109768501" }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2013-0169", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "TLS and DTLS versions 1.1 and 1.2, as used in the affected product, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the \"Lucky Thirteen\" issue.", "title": "Summary" }, { "category": "summary", "text": "The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality of the device.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "https://support.industry.siemens.com/cs/ww/en/view/109768501", "url": "https://support.industry.siemens.com/cs/ww/en/view/109768501" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0169" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "vendor_fix", "details": "Restrict network access to the device to the extent possible", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "Update to V3.2.1 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768501 ", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109768501" }, { "category": "vendor_fix", "details": "Update to V3.2.1 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768501 ", "product_ids": [ "CSAFPID-0002" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109768501" }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] } ] }
cve-2011-3389
Vulnerability from cvelistv5
Published
2011-09-06 19:00
Modified
2024-08-06 23:29
Severity ?
EPSS score ?
Summary
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T23:29:56.878Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "74829", "tags": [ "vdb-entry", "x_refsource_OSVDB", "x_transferred" ], "url": "http://osvdb.org/74829" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://eprint.iacr.org/2004/111" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://isc.sans.edu/diary/SSL+TLS+part+3+/11635" }, { "name": "GLSA-201406-32", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml" }, { "name": "48692", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/48692" }, { "name": "HPSBMU02799", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=134254866602253\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf" }, { "name": "SSRT100805", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=133365109612558\u0026w=2" }, { "name": "55322", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/55322" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://support.apple.com/kb/HT5130" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=737506" }, { "name": "HPSBUX02730", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=132750579901589\u0026w=2" }, { "name": "SUSE-SU-2012:0602", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html" }, { "name": "1025997", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id?1025997" }, { "name": "TA12-010A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "url": "http://www.us-cert.gov/cas/techalerts/TA12-010A.html" }, { "name": "APPLE-SA-2011-10-12-1", "tags": [ "vendor-advisory", "x_refsource_APPLE", "x_transferred" ], "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html" }, { "name": "SUSE-SU-2012:0114", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html" }, { "name": "49388", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/49388" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://ekoparty.org/2011/juliano-rizzo.php" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://downloads.asterisk.org/pub/security/AST-2016-001.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail" }, { "name": "RHSA-2013:1455", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html" }, { "name": "55351", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/55351" }, { "name": "SSRT100710", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=132750579901589\u0026w=2" }, { "name": "VU#864643", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "url": "http://www.kb.cert.org/vuls/id/864643" }, { "name": "APPLE-SA-2013-10-22-3", "tags": [ "vendor-advisory", "x_refsource_APPLE", "x_transferred" ], "url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html" }, { "name": "49778", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/49778" }, { "name": "DSA-2398", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "http://www.debian.org/security/2012/dsa-2398" }, { "name": "48948", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/48948" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://support.apple.com/kb/HT6150" }, { "name": "APPLE-SA-2012-02-01-1", "tags": [ "vendor-advisory", "x_refsource_APPLE", "x_transferred" ], "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://technet.microsoft.com/security/advisory/2588513" }, { "name": "openSUSE-SU-2012:0063", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "https://hermes.opensuse.org/messages/13155432" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx" }, { "name": "RHSA-2011:1384", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://www.redhat.com/support/errata/RHSA-2011-1384.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.opera.com/docs/changelogs/windows/1151/" }, { "name": "openSUSE-SU-2012:0030", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "https://hermes.opensuse.org/messages/13154861" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://eprint.iacr.org/2006/136" }, { "name": "48915", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/48915" }, { "name": "GLSA-201203-02", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "http://security.gentoo.org/glsa/glsa-201203-02.xml" }, { "name": "SSRT100740", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=132872385320240\u0026w=2" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html" }, { "name": "48256", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/48256" }, { "name": "APPLE-SA-2012-09-19-2", "tags": [ "vendor-advisory", "x_refsource_APPLE", "x_transferred" ], "url": "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html" }, { "name": "1026103", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id?1026103" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://support.apple.com/kb/HT4999" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://support.apple.com/kb/HT5501" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://www.insecure.cl/Beast-SSL.rar" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://support.apple.com/kb/HT5001" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.opera.com/docs/changelogs/mac/1160/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://curl.haxx.se/docs/adv_20120124B.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.opera.com/support/kb/view/1004/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html" }, { "name": "1026704", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id?1026704" }, { "name": "APPLE-SA-2012-07-25-2", "tags": [ "vendor-advisory", "x_refsource_APPLE", "x_transferred" ], "url": "http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html" }, { "name": "HPSBMU02742", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=132872385320240\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue" }, { "name": "RHSA-2012:0508", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2012-0508.html" }, { "name": "45791", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/45791" }, { "name": "1029190", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id/1029190" }, { "name": "MDVSA-2012:058", "tags": [ "vendor-advisory", "x_refsource_MANDRIVA", "x_transferred" ], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:058" }, { "name": "47998", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/47998" }, { "name": "SSRT100867", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=134254957702612\u0026w=2" }, { "name": "49198", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/49198" }, { "name": "RHSA-2012:0006", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://www.redhat.com/support/errata/RHSA-2012-0006.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.opera.com/docs/changelogs/windows/1160/" }, { "name": "SUSE-SU-2012:0122", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html" }, { "name": "HPSBUX02777", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=133728004526190\u0026w=2" }, { "name": "oval:org.mitre.oval:def:14752", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.opera.com/docs/changelogs/unix/1151/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.opera.com/docs/changelogs/mac/1151/" }, { "name": "MS12-006", "tags": [ "vendor-advisory", "x_refsource_MS", "x_transferred" ], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006" }, { "name": "HPSBUX02760", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=133365109612558\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.opera.com/docs/changelogs/unix/1160/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://support.apple.com/kb/HT5281" }, { "name": "SSRT100854", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=133728004526190\u0026w=2" }, { "name": "APPLE-SA-2011-10-12-2", "tags": [ "vendor-advisory", "x_refsource_APPLE", "x_transferred" ], "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.novell.com/show_bug.cgi?id=719047" }, { "name": "HPSBMU02900", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://vnhacker.blogspot.com/2011/09/beast.html" }, { "name": "USN-1263-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-1263-1" }, { "name": "APPLE-SA-2012-05-09-1", "tags": [ "vendor-advisory", "x_refsource_APPLE", "x_transferred" ], "url": "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html" }, { "name": "55350", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/55350" }, { "name": "HPSBMU02797", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=134254957702612\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.ibm.com/developerworks/java/jdk/alerts/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" }, { "name": "openSUSE-SU-2020:0086", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2004-05-11T00:00:00", "descriptions": [ { "lang": "en", "value": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-01-21T21:06:36", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "74829", "tags": [ "vdb-entry", "x_refsource_OSVDB" ], "url": "http://osvdb.org/74829" }, { "tags": [ "x_refsource_MISC" ], "url": "http://eprint.iacr.org/2004/111" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html" }, { "tags": [ "x_refsource_MISC" ], "url": "http://isc.sans.edu/diary/SSL+TLS+part+3+/11635" }, { "name": "GLSA-201406-32", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml" }, { "name": "48692", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/48692" }, { "name": "HPSBMU02799", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=134254866602253\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf" }, { "name": "SSRT100805", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=133365109612558\u0026w=2" }, { "name": "55322", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/55322" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://support.apple.com/kb/HT5130" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=737506" }, { "name": "HPSBUX02730", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=132750579901589\u0026w=2" }, { "name": "SUSE-SU-2012:0602", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html" }, { "name": "1025997", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id?1025997" }, { "name": "TA12-010A", "tags": [ "third-party-advisory", "x_refsource_CERT" ], "url": "http://www.us-cert.gov/cas/techalerts/TA12-010A.html" }, { "name": "APPLE-SA-2011-10-12-1", "tags": [ "vendor-advisory", "x_refsource_APPLE" ], "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html" }, { "name": "SUSE-SU-2012:0114", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html" }, { "name": "49388", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/49388" }, { "tags": [ "x_refsource_MISC" ], "url": "http://ekoparty.org/2011/juliano-rizzo.php" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://downloads.asterisk.org/pub/security/AST-2016-001.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail" }, { "name": "RHSA-2013:1455", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html" }, { "name": "55351", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/55351" }, { "name": "SSRT100710", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=132750579901589\u0026w=2" }, { "name": "VU#864643", "tags": [ "third-party-advisory", "x_refsource_CERT-VN" ], "url": "http://www.kb.cert.org/vuls/id/864643" }, { "name": "APPLE-SA-2013-10-22-3", "tags": [ "vendor-advisory", "x_refsource_APPLE" ], "url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html" }, { "name": "49778", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/49778" }, { "name": "DSA-2398", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "http://www.debian.org/security/2012/dsa-2398" }, { "name": "48948", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/48948" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://support.apple.com/kb/HT6150" }, { "name": "APPLE-SA-2012-02-01-1", "tags": [ "vendor-advisory", "x_refsource_APPLE" ], "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://technet.microsoft.com/security/advisory/2588513" }, { "name": "openSUSE-SU-2012:0063", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "https://hermes.opensuse.org/messages/13155432" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx" }, { "name": "RHSA-2011:1384", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://www.redhat.com/support/errata/RHSA-2011-1384.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.opera.com/docs/changelogs/windows/1151/" }, { "name": "openSUSE-SU-2012:0030", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "https://hermes.opensuse.org/messages/13154861" }, { "tags": [ "x_refsource_MISC" ], "url": "http://eprint.iacr.org/2006/136" }, { "name": "48915", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/48915" }, { "name": "GLSA-201203-02", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "http://security.gentoo.org/glsa/glsa-201203-02.xml" }, { "name": "SSRT100740", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=132872385320240\u0026w=2" }, { "tags": [ "x_refsource_MISC" ], "url": "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html" }, { "name": "48256", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/48256" }, { "name": "APPLE-SA-2012-09-19-2", "tags": [ "vendor-advisory", "x_refsource_APPLE" ], "url": "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html" }, { "name": "1026103", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id?1026103" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://support.apple.com/kb/HT4999" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://support.apple.com/kb/HT5501" }, { "tags": [ "x_refsource_MISC" ], "url": "http://www.insecure.cl/Beast-SSL.rar" }, { "tags": [ "x_refsource_MISC" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://support.apple.com/kb/HT5001" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.opera.com/docs/changelogs/mac/1160/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://curl.haxx.se/docs/adv_20120124B.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.opera.com/support/kb/view/1004/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html" }, { "name": "1026704", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id?1026704" }, { "name": "APPLE-SA-2012-07-25-2", "tags": [ "vendor-advisory", "x_refsource_APPLE" ], "url": "http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html" }, { "name": "HPSBMU02742", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=132872385320240\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue" }, { "name": "RHSA-2012:0508", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2012-0508.html" }, { "name": "45791", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/45791" }, { "name": "1029190", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id/1029190" }, { "name": "MDVSA-2012:058", "tags": [ "vendor-advisory", "x_refsource_MANDRIVA" ], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:058" }, { "name": "47998", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/47998" }, { "name": "SSRT100867", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=134254957702612\u0026w=2" }, { "name": "49198", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/49198" }, { "name": "RHSA-2012:0006", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://www.redhat.com/support/errata/RHSA-2012-0006.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.opera.com/docs/changelogs/windows/1160/" }, { "name": "SUSE-SU-2012:0122", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html" }, { "name": "HPSBUX02777", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=133728004526190\u0026w=2" }, { "name": "oval:org.mitre.oval:def:14752", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.opera.com/docs/changelogs/unix/1151/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.opera.com/docs/changelogs/mac/1151/" }, { "name": "MS12-006", "tags": [ "vendor-advisory", "x_refsource_MS" ], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006" }, { "name": "HPSBUX02760", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=133365109612558\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.opera.com/docs/changelogs/unix/1160/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://support.apple.com/kb/HT5281" }, { "name": "SSRT100854", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=133728004526190\u0026w=2" }, { "name": "APPLE-SA-2011-10-12-2", "tags": [ "vendor-advisory", "x_refsource_APPLE" ], "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.novell.com/show_bug.cgi?id=719047" }, { "name": "HPSBMU02900", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862" }, { "tags": [ "x_refsource_MISC" ], "url": "http://vnhacker.blogspot.com/2011/09/beast.html" }, { "name": "USN-1263-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "http://www.ubuntu.com/usn/USN-1263-1" }, { "name": "APPLE-SA-2012-05-09-1", "tags": [ "vendor-advisory", "x_refsource_APPLE" ], "url": "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html" }, { "name": "55350", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/55350" }, { "name": "HPSBMU02797", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=134254957702612\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.ibm.com/developerworks/java/jdk/alerts/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" }, { "name": "openSUSE-SU-2020:0086", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2011-3389", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "74829", "refsource": "OSVDB", "url": "http://osvdb.org/74829" }, { "name": "http://eprint.iacr.org/2004/111", "refsource": "MISC", "url": "http://eprint.iacr.org/2004/111" }, { "name": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html" }, { "name": "http://isc.sans.edu/diary/SSL+TLS+part+3+/11635", "refsource": "MISC", "url": "http://isc.sans.edu/diary/SSL+TLS+part+3+/11635" }, { "name": "GLSA-201406-32", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml" }, { "name": "48692", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/48692" }, { "name": "HPSBMU02799", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=134254866602253\u0026w=2" }, { "name": "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf", "refsource": "CONFIRM", "url": "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf" }, { "name": "SSRT100805", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=133365109612558\u0026w=2" }, { "name": "55322", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/55322" }, { "name": "http://support.apple.com/kb/HT5130", "refsource": "CONFIRM", "url": "http://support.apple.com/kb/HT5130" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=737506", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=737506" }, { "name": "HPSBUX02730", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=132750579901589\u0026w=2" }, { "name": "SUSE-SU-2012:0602", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html" }, { "name": "1025997", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1025997" }, { "name": "TA12-010A", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA12-010A.html" }, { "name": "APPLE-SA-2011-10-12-1", "refsource": "APPLE", "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html" }, { "name": "SUSE-SU-2012:0114", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html" }, { "name": "49388", "refsource": "BID", "url": "http://www.securityfocus.com/bid/49388" }, { "name": "http://ekoparty.org/2011/juliano-rizzo.php", "refsource": "MISC", "url": "http://ekoparty.org/2011/juliano-rizzo.php" }, { "name": "http://downloads.asterisk.org/pub/security/AST-2016-001.html", "refsource": "CONFIRM", "url": "http://downloads.asterisk.org/pub/security/AST-2016-001.html" }, { "name": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail", "refsource": "CONFIRM", "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail" }, { "name": "RHSA-2013:1455", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html" }, { "name": "55351", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/55351" }, { "name": "SSRT100710", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=132750579901589\u0026w=2" }, { "name": "VU#864643", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/864643" }, { "name": "APPLE-SA-2013-10-22-3", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html" }, { "name": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html" }, { "name": "49778", "refsource": "BID", "url": "http://www.securityfocus.com/bid/49778" }, { "name": "DSA-2398", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2012/dsa-2398" }, { "name": "48948", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/48948" }, { "name": "http://support.apple.com/kb/HT6150", "refsource": "CONFIRM", "url": "http://support.apple.com/kb/HT6150" }, { "name": "APPLE-SA-2012-02-01-1", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html" }, { "name": "http://technet.microsoft.com/security/advisory/2588513", "refsource": "CONFIRM", "url": "http://technet.microsoft.com/security/advisory/2588513" }, { "name": "openSUSE-SU-2012:0063", "refsource": "SUSE", "url": "https://hermes.opensuse.org/messages/13155432" }, { "name": "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx", "refsource": "CONFIRM", "url": "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx" }, { "name": "RHSA-2011:1384", "refsource": "REDHAT", "url": "http://www.redhat.com/support/errata/RHSA-2011-1384.html" }, { "name": "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx", "refsource": "CONFIRM", "url": "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx" }, { "name": "http://www.opera.com/docs/changelogs/windows/1151/", "refsource": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/windows/1151/" }, { "name": "openSUSE-SU-2012:0030", "refsource": "SUSE", "url": "https://hermes.opensuse.org/messages/13154861" }, { "name": "http://eprint.iacr.org/2006/136", "refsource": "MISC", "url": "http://eprint.iacr.org/2006/136" }, { "name": "48915", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/48915" }, { "name": "GLSA-201203-02", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-201203-02.xml" }, { "name": "SSRT100740", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=132872385320240\u0026w=2" }, { "name": "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html", "refsource": "MISC", "url": "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html" }, { "name": "48256", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/48256" }, { "name": "APPLE-SA-2012-09-19-2", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html" }, { "name": "1026103", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1026103" }, { "name": "http://support.apple.com/kb/HT4999", "refsource": "CONFIRM", "url": "http://support.apple.com/kb/HT4999" }, { "name": "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html", "refsource": "CONFIRM", "url": "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html" }, { "name": "http://support.apple.com/kb/HT5501", "refsource": "CONFIRM", "url": "http://support.apple.com/kb/HT5501" }, { "name": "http://www.insecure.cl/Beast-SSL.rar", "refsource": "MISC", "url": "http://www.insecure.cl/Beast-SSL.rar" }, { "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "name": "http://support.apple.com/kb/HT5001", "refsource": "CONFIRM", "url": "http://support.apple.com/kb/HT5001" }, { "name": "http://www.opera.com/docs/changelogs/mac/1160/", "refsource": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/mac/1160/" }, { "name": "http://curl.haxx.se/docs/adv_20120124B.html", "refsource": "CONFIRM", "url": "http://curl.haxx.se/docs/adv_20120124B.html" }, { "name": "http://www.opera.com/support/kb/view/1004/", "refsource": "CONFIRM", "url": "http://www.opera.com/support/kb/view/1004/" }, { "name": "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html" }, { "name": "1026704", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1026704" }, { "name": "APPLE-SA-2012-07-25-2", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html" }, { "name": "HPSBMU02742", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=132872385320240\u0026w=2" }, { "name": "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue", "refsource": "CONFIRM", "url": "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue" }, { "name": "RHSA-2012:0508", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2012-0508.html" }, { "name": "45791", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/45791" }, { "name": "1029190", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1029190" }, { "name": "MDVSA-2012:058", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:058" }, { "name": "47998", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/47998" }, { "name": "SSRT100867", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=134254957702612\u0026w=2" }, { "name": "49198", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/49198" }, { "name": "RHSA-2012:0006", "refsource": "REDHAT", "url": "http://www.redhat.com/support/errata/RHSA-2012-0006.html" }, { "name": "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/", "refsource": "CONFIRM", "url": "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/" }, { "name": "http://www.opera.com/docs/changelogs/windows/1160/", "refsource": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/windows/1160/" }, { "name": "SUSE-SU-2012:0122", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html" }, { "name": "HPSBUX02777", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=133728004526190\u0026w=2" }, { "name": "oval:org.mitre.oval:def:14752", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752" }, { "name": "http://www.opera.com/docs/changelogs/unix/1151/", "refsource": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/unix/1151/" }, { "name": "http://www.opera.com/docs/changelogs/mac/1151/", "refsource": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/mac/1151/" }, { "name": "MS12-006", "refsource": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006" }, { "name": "HPSBUX02760", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=133365109612558\u0026w=2" }, { "name": "http://www.opera.com/docs/changelogs/unix/1160/", "refsource": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/unix/1160/" }, { "name": "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html", "refsource": "CONFIRM", "url": "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html" }, { "name": "http://support.apple.com/kb/HT5281", "refsource": "CONFIRM", "url": "http://support.apple.com/kb/HT5281" }, { "name": "SSRT100854", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=133728004526190\u0026w=2" }, { "name": "APPLE-SA-2011-10-12-2", "refsource": "APPLE", "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html" }, { "name": "https://bugzilla.novell.com/show_bug.cgi?id=719047", "refsource": "CONFIRM", "url": "https://bugzilla.novell.com/show_bug.cgi?id=719047" }, { "name": "HPSBMU02900", "refsource": "HP", "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862" }, { "name": "http://vnhacker.blogspot.com/2011/09/beast.html", "refsource": "MISC", "url": "http://vnhacker.blogspot.com/2011/09/beast.html" }, { "name": "USN-1263-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1263-1" }, { "name": "APPLE-SA-2012-05-09-1", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html" }, { "name": "55350", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/55350" }, { "name": "HPSBMU02797", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=134254957702612\u0026w=2" }, { "name": "http://www.ibm.com/developerworks/java/jdk/alerts/", "refsource": "CONFIRM", "url": "http://www.ibm.com/developerworks/java/jdk/alerts/" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" }, { "name": "openSUSE-SU-2020:0086", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2011-3389", "datePublished": "2011-09-06T19:00:00", "dateReserved": "2011-09-05T00:00:00", "dateUpdated": "2024-08-06T23:29:56.878Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2016-6329
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 01:29
Severity ?
EPSS score ?
Summary
OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.
References
▼ | URL | Tags |
---|---|---|
https://sweet32.info/ | x_refsource_MISC | |
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403 | x_refsource_CONFIRM | |
http://www.securitytracker.com/id/1036695 | vdb-entry, x_refsource_SECTRACK | |
http://www-01.ibm.com/support/docview.wss?uid=swg21995039 | x_refsource_CONFIRM | |
http://www-01.ibm.com/support/docview.wss?uid=swg21991482 | x_refsource_CONFIRM | |
https://security.gentoo.org/glsa/201611-02 | vendor-advisory, x_refsource_GENTOO | |
https://community.openvpn.net/openvpn/wiki/SWEET32 | x_refsource_CONFIRM | |
http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697 | x_refsource_CONFIRM | |
http://www.securityfocus.com/bid/92631 | vdb-entry, x_refsource_BID | |
https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf | x_refsource_CONFIRM |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T01:29:18.449Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://sweet32.info/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403" }, { "name": "1036695", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id/1036695" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21995039" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21991482" }, { "name": "GLSA-201611-02", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201611-02" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://community.openvpn.net/openvpn/wiki/SWEET32" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697" }, { "name": "92631", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/92631" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2016-08-24T00:00:00", "descriptions": [ { "lang": "en", "value": "OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a \"Sweet32\" attack." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2019-07-09T12:06:03", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://sweet32.info/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403" }, { "name": "1036695", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id/1036695" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21995039" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21991482" }, { "name": "GLSA-201611-02", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/201611-02" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://community.openvpn.net/openvpn/wiki/SWEET32" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697" }, { "name": "92631", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/92631" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" } ] } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2016-6329", "datePublished": "2017-01-31T22:00:00", "dateReserved": "2016-07-26T00:00:00", "dateUpdated": "2024-08-06T01:29:18.449Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2013-0169
Vulnerability from cvelistv5
Published
2013-02-08 19:00
Modified
2024-08-06 14:18
Severity ?
EPSS score ?
Summary
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T14:18:09.503Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "[debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.matrixssl.org/news.html" }, { "name": "RHSA-2013:0587", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0587.html" }, { "name": "GLSA-201406-32", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml" }, { "name": "FEDORA-2013-4403", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html" }, { "name": "TA13-051A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "url": "http://www.us-cert.gov/cas/techalerts/TA13-051A.html" }, { "name": "oval:org.mitre.oval:def:19016", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19016" }, { "name": "MDVSA-2013:095", "tags": [ "vendor-advisory", "x_refsource_MANDRIVA", "x_transferred" ], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095" }, { "name": "55139", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/55139" }, { "name": "55322", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/55322" }, { "name": "oval:org.mitre.oval:def:19608", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19608" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.openssl.org/news/secadv_20130204.txt" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html" }, { "name": "openSUSE-SU-2013:0378", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html" }, { "name": "DSA-2622", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "http://www.debian.org/security/2013/dsa-2622" }, { "name": "57778", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/57778" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047" }, { "name": "[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://openwall.com/lists/oss-security/2013/02/05/24" }, { "name": "RHSA-2013:1455", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html" }, { "name": "55351", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/55351" }, { "name": "HPSBUX02856", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://puppet.com/security/cve/cve-2013-0169" }, { "name": "SSRT101289", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2" }, { "name": "openSUSE-SU-2016:0640", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html" }, { "name": "SSRT101108", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2" }, { "name": "SUSE-SU-2013:0328", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html" }, { "name": "RHSA-2013:0833", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0833.html" }, { "name": "USN-1735-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-1735-1" }, { "name": "SUSE-SU-2014:0320", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html" }, { "name": "HPSBUX02857", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c03883001" }, { "name": "53623", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/53623" }, { "name": "SUSE-SU-2013:0701", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html" }, { "name": "VU#737740", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "url": "http://www.kb.cert.org/vuls/id/737740" }, { "name": "oval:org.mitre.oval:def:19424", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19424" }, { "name": "HPSBUX02909", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2" }, { "name": "DSA-2621", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "http://www.debian.org/security/2013/dsa-2621" }, { "name": "RHSA-2013:0783", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0783.html" }, { "name": "HPSBMU02874", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2" }, { "name": "APPLE-SA-2013-09-12-1", "tags": [ "vendor-advisory", "x_refsource_APPLE", "x_transferred" ], "url": "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html" }, { "name": "55108", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/55108" }, { "name": "RHSA-2013:0782", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0782.html" }, { "name": "HPSBOV02852", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2" }, { "name": "SSRT101103", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2" }, { "name": "SSRT101104", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2" }, { "name": "SUSE-SU-2015:0578", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html" }, { "name": "openSUSE-SU-2013:0375", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released" }, { "name": "oval:org.mitre.oval:def:19540", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19540" }, { "name": "1029190", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id/1029190" }, { "name": "oval:org.mitre.oval:def:18841", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18841" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.splunk.com/view/SP-CAAAHXG" }, { "name": "RHSA-2013:1456", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://support.apple.com/kb/HT5880" }, { "name": "SSRT101184", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2" }, { "name": "55350", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/55350" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2013-02-05T00:00:00", "descriptions": [ { "lang": "en", "value": "The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the \"Lucky Thirteen\" issue." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2019-07-09T12:06:03", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "[debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.matrixssl.org/news.html" }, { "name": "RHSA-2013:0587", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0587.html" }, { "name": "GLSA-201406-32", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml" }, { "name": "FEDORA-2013-4403", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html" }, { "name": "TA13-051A", "tags": [ "third-party-advisory", "x_refsource_CERT" ], "url": "http://www.us-cert.gov/cas/techalerts/TA13-051A.html" }, { "name": "oval:org.mitre.oval:def:19016", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19016" }, { "name": "MDVSA-2013:095", "tags": [ "vendor-advisory", "x_refsource_MANDRIVA" ], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095" }, { "name": "55139", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/55139" }, { "name": "55322", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/55322" }, { "name": "oval:org.mitre.oval:def:19608", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19608" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.openssl.org/news/secadv_20130204.txt" }, { "tags": [ "x_refsource_MISC" ], "url": "http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084" }, { "tags": [ "x_refsource_MISC" ], "url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html" }, { "name": "openSUSE-SU-2013:0378", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html" }, { "name": "DSA-2622", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "http://www.debian.org/security/2013/dsa-2622" }, { "name": "57778", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/57778" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047" }, { "name": "[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://openwall.com/lists/oss-security/2013/02/05/24" }, { "name": "RHSA-2013:1455", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html" }, { "name": "55351", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/55351" }, { "name": "HPSBUX02856", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://puppet.com/security/cve/cve-2013-0169" }, { "name": "SSRT101289", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2" }, { "name": "openSUSE-SU-2016:0640", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html" }, { "name": "SSRT101108", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2" }, { "name": "SUSE-SU-2013:0328", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html" }, { "name": "RHSA-2013:0833", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0833.html" }, { "name": "USN-1735-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "http://www.ubuntu.com/usn/USN-1735-1" }, { "name": "SUSE-SU-2014:0320", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html" }, { "name": "HPSBUX02857", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c03883001" }, { "name": "53623", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/53623" }, { "name": "SUSE-SU-2013:0701", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html" }, { "name": "VU#737740", "tags": [ "third-party-advisory", "x_refsource_CERT-VN" ], "url": "http://www.kb.cert.org/vuls/id/737740" }, { "name": "oval:org.mitre.oval:def:19424", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19424" }, { "name": "HPSBUX02909", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2" }, { "name": "DSA-2621", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "http://www.debian.org/security/2013/dsa-2621" }, { "name": "RHSA-2013:0783", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0783.html" }, { "name": "HPSBMU02874", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2" }, { "name": "APPLE-SA-2013-09-12-1", "tags": [ "vendor-advisory", "x_refsource_APPLE" ], "url": "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html" }, { "name": "55108", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/55108" }, { "name": "RHSA-2013:0782", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0782.html" }, { "name": "HPSBOV02852", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2" }, { "name": "SSRT101103", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2" }, { "name": "SSRT101104", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2" }, { "name": "SUSE-SU-2015:0578", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html" }, { "name": "openSUSE-SU-2013:0375", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released" }, { "name": "oval:org.mitre.oval:def:19540", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19540" }, { "name": "1029190", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id/1029190" }, { "name": "oval:org.mitre.oval:def:18841", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18841" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.splunk.com/view/SP-CAAAHXG" }, { "name": "RHSA-2013:1456", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://support.apple.com/kb/HT5880" }, { "name": "SSRT101184", "tags": [ "vendor-advisory", "x_refsource_HP" ], "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2" }, { "name": "55350", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/55350" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2013-0169", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the \"Lucky Thirteen\" issue." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "[debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html" }, { "name": "http://www.matrixssl.org/news.html", "refsource": "CONFIRM", "url": "http://www.matrixssl.org/news.html" }, { "name": "RHSA-2013:0587", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0587.html" }, { "name": "GLSA-201406-32", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml" }, { "name": "FEDORA-2013-4403", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html" }, { "name": "TA13-051A", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA13-051A.html" }, { "name": "oval:org.mitre.oval:def:19016", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19016" }, { "name": "MDVSA-2013:095", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095" }, { "name": "55139", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/55139" }, { "name": "55322", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/55322" }, { "name": "oval:org.mitre.oval:def:19608", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19608" }, { "name": "http://www.openssl.org/news/secadv_20130204.txt", "refsource": "CONFIRM", "url": "http://www.openssl.org/news/secadv_20130204.txt" }, { "name": "http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/", "refsource": "MISC", "url": "http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/" }, { "name": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084", "refsource": "CONFIRM", "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084" }, { "name": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf", "refsource": "MISC", "url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf" }, { "name": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html" }, { "name": "openSUSE-SU-2013:0378", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html" }, { "name": "DSA-2622", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2013/dsa-2622" }, { "name": "57778", "refsource": "BID", "url": "http://www.securityfocus.com/bid/57778" }, { "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047" }, { "name": "[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations", "refsource": "MLIST", "url": "http://openwall.com/lists/oss-security/2013/02/05/24" }, { "name": "RHSA-2013:1455", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html" }, { "name": "55351", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/55351" }, { "name": "HPSBUX02856", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2" }, { "name": "https://puppet.com/security/cve/cve-2013-0169", "refsource": "CONFIRM", "url": "https://puppet.com/security/cve/cve-2013-0169" }, { "name": "SSRT101289", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2" }, { "name": "openSUSE-SU-2016:0640", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html" }, { "name": "SSRT101108", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2" }, { "name": "SUSE-SU-2013:0328", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html" }, { "name": "RHSA-2013:0833", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0833.html" }, { "name": "USN-1735-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1735-1" }, { "name": "SUSE-SU-2014:0320", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html" }, { "name": "HPSBUX02857", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2" }, { "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c03883001", "refsource": "CONFIRM", "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c03883001" }, { "name": "53623", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/53623" }, { "name": "SUSE-SU-2013:0701", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html" }, { "name": "VU#737740", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/737740" }, { "name": "oval:org.mitre.oval:def:19424", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19424" }, { "name": "HPSBUX02909", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2" }, { "name": "DSA-2621", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2013/dsa-2621" }, { "name": "RHSA-2013:0783", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0783.html" }, { "name": "HPSBMU02874", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2" }, { "name": "APPLE-SA-2013-09-12-1", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html" }, { "name": "55108", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/55108" }, { "name": "RHSA-2013:0782", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0782.html" }, { "name": "HPSBOV02852", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2" }, { "name": "SSRT101103", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2" }, { "name": "SSRT101104", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2" }, { "name": "SUSE-SU-2015:0578", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html" }, { "name": "openSUSE-SU-2013:0375", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html" }, { "name": "https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released", "refsource": "CONFIRM", "url": "https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released" }, { "name": "oval:org.mitre.oval:def:19540", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19540" }, { "name": "1029190", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1029190" }, { "name": "oval:org.mitre.oval:def:18841", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18841" }, { "name": "http://www.splunk.com/view/SP-CAAAHXG", "refsource": "CONFIRM", "url": "http://www.splunk.com/view/SP-CAAAHXG" }, { "name": "RHSA-2013:1456", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html" }, { "name": "http://support.apple.com/kb/HT5880", "refsource": "CONFIRM", "url": "http://support.apple.com/kb/HT5880" }, { "name": "SSRT101184", "refsource": "HP", "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2" }, { "name": "55350", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/55350" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" } ] } } } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2013-0169", "datePublished": "2013-02-08T19:00:00", "dateReserved": "2012-12-06T00:00:00", "dateUpdated": "2024-08-06T14:18:09.503Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.