Debian DSA-2622-1 : polarssl - several vulnerabilities

medium Nessus Plugin ID 64624

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Multiple vulnerabilities have been found in PolarSSL. The Common Vulnerabilities and Exposures project identifies the following issues :

- CVE-2013-0169 A timing side channel attack has been found in CBC padding allowing an attacker to recover pieces of plaintext via statistical analysis of crafted packages, known as the 'Lucky Thirteen' issue.

- CVE-2013-1621 An array index error might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session.

- CVE-2013-1622 Malformed CBC data in a TLS session could allow remote attackers to conduct distinguishing attacks via statistical analysis of timing side-channel data for crafted packets.

Solution

Upgrade the polarssl packages.

For the stable distribution (squeeze), these problems have been fixed in version 0.12.1-1squeeze1.

Plugin Details

Severity: Medium

ID: 64624

File Name: debian_DSA-2622.nasl

Version: 1.26

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 2/14/2013

Updated: 12/5/2022

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:6.0, p-cpe:/a:debian:debian_linux:polarssl

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 2/13/2013

Reference Information

CVE: CVE-2013-0169, CVE-2013-1621

BID: 57776, 57778, 57781

DSA: 2622

Detections

Analytics