Security Information / 2013 / Security Information -- DSA-2622-1 polarssl

Debian Security Advisory

DSA-2622-1 polarssl -- several vulnerabilities

Date Reported:

13 Feb 2013

Affected Packages:

polarssl

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 699887.
In Mitre's CVE dictionary: CVE-2013-0169, CVE-2013-1621, CVE-2013-1622.

More information:

Multiple vulnerabilities have been found in PolarSSL. The Common Vulnerabilities and Exposures project identifies the following issues:

• CVE-2013-0169

  A timing side channel attack has been found in CBC padding allowing an attacker to recover pieces of plaintext via statistical analysis of crafted packages, known as the Lucky Thirteen issue.

• CVE-2013-1621

  An array index error might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session.

• CVE-2013-1622

  Malformed CBC data in a TLS session could allow remote attackers to conduct distinguishing attacks via statistical analysis of timing side-channel data for crafted packets.

For the stable distribution (squeeze), these problems have been fixed in version 0.12.1-1squeeze1.

For the testing distribution (wheezy), and the unstable distribution (sid), these problems have been fixed in version 1.1.4-2.

We recommend that you upgrade your polarssl packages.