CVE-2013-0169: The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on… | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Feb 8, 2013

CVE-2013-0169

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on…

–

CVSS

35.6%

EPSS

No

On KEV

Description

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

Exploitation

Is it being used?

Exploit prediction (EPSS)35.6% · higher than 98% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

OP

Openjdk · Oracle

1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; +34 more · source: NVD

OP

Openssl · Openssl

0.9.8 through 0.9.8x; 1.0.0 through 1.0.0j; 1.0.1 through 1.0.1d · source: NVD

PO

Polarssl · Polarssl

0.10.0; 0.10.1; 0.11.0; 0.11.1; 0.12.0; 0.12.1; +16 more · source: NVD

Affected product

OP

Openssl

Openssl

All Openssl CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2013-0169

https://www.cve.org/CVERecord?id=CVE-2013-0169

Third Party Advisory

http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/

http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html

More from Openssl

7.5

OpenSSL Information Disclosure Vulnerability

9.8

Untrusted Sender DN Used as Format String in CMP Response Validation

9.8

Heap Buffer Overflow in Hexadecimal Conversion

9.8

RSA implementation bug in AVX512IFMA instructions

9.8

SM2 Decryption Buffer Overflow