Vulnerability   
Search   
    Search 191973 CVE descriptions
and 86218 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.702782
Category:Debian Local Security Checks
Title:Debian Security Advisory DSA 2782-1 (polarssl - several vulnerabilities)
Summary:Multiple security issues have been discovered in PolarSSL, a lightweight;crypto and SSL/TLS library:;;CVE-2013-4623;Jack Lloyd discovered a denial of service vulnerability in the;parsing of PEM-encoded certificates.;;CVE-2013-5914;Paul Brodeur and TrustInSoft discovered a buffer overflow in the;ssl_read_record() function, allowing the potential execution of;arbitrary code.;;CVE-2013-5915;Cyril Arnaud and Pierre-Alain Fouque discovered timing attacks against;the RSA implementation.
Description:Summary:
Multiple security issues have been discovered in PolarSSL, a lightweight
crypto and SSL/TLS library:

CVE-2013-4623
Jack Lloyd discovered a denial of service vulnerability in the
parsing of PEM-encoded certificates.

CVE-2013-5914
Paul Brodeur and TrustInSoft discovered a buffer overflow in the
ssl_read_record() function, allowing the potential execution of
arbitrary code.

CVE-2013-5915
Cyril Arnaud and Pierre-Alain Fouque discovered timing attacks against
the RSA implementation.

Affected Software/OS:
polarssl on Debian Linux

Solution:
For the oldstable distribution (squeeze), these problems will be fixed in
version 1.2.9-1~
deb6u1 soon (due to a technical limitation the updates
cannot be released synchronously).

For the stable distribution (wheezy), these problems have been fixed in
version 1.2.9-1~
deb7u1.

For the unstable distribution (sid), these problems have been fixed in
version 1.3.1-1.

We recommend that you upgrade your polarssl packages.

CVSS Score:
6.8

CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2013-5914
Debian Security Information: DSA-2782 (Google Search)
http://www.debian.org/security/2013/dsa-2782
Common Vulnerability Exposure (CVE) ID: CVE-2013-4623
BugTraq ID: 61764
http://www.securityfocus.com/bid/61764
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116351.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115922.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115927.html
Common Vulnerability Exposure (CVE) ID: CVE-2013-5915
BugTraq ID: 62771
http://www.securityfocus.com/bid/62771
http://lists.fedoraproject.org/pipermail/package-announce/2013-October/118758.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119018.html
http://osvdb.org/98049
http://secunia.com/advisories/55084
CopyrightCopyright (C) 2013 Greenbone Networks GmbH http://greenbone.net

This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.