NetSight
IP …
medium4.3

CVE-2013-1620

The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation …

Impact

The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

Affected products

VendorProductAffected versions
MozillaNetwork Security Services
before 3.14.3
CanonicalUbuntu Linux
Versions 10.04, 11.10, 12.04, 12.10
OracleEnterprise Manager Ops Center
Versions 11.1, 12.1, 12.2
OracleGlassfish Communications Server
Version 2.0
OracleGlassfish Server
Version 2.1.1
OracleIplanet Web Proxy Server
Version 4.0
OracleIplanet Web Server
Versions 6.1, 7.0
OracleOpensso
Version 3.0-03
OracleTraffic Director
Versions 11.1.1.6.0, 11.1.1.7.0
OracleVm Server
Version 3.2
RedhatEnterprise Linux Desktop
Versions 5.0, 6.0
RedhatEnterprise Linux Eus
Version 5.9

Weakness classification

CWE-203

References