ID CVE-2013-1619
Summary The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
References
Vulnerable Configurations
  • GNU GnuTLS 2.5.0
    cpe:2.3:a:gnu:gnutls:2.5.0
  • GNU GnuTLS 2.12.0
    cpe:2.3:a:gnu:gnutls:2.12.0
  • GNU GnuTLS 2.12.1
    cpe:2.3:a:gnu:gnutls:2.12.1
  • GNU GnuTLS 2.12.2
    cpe:2.3:a:gnu:gnutls:2.12.2
  • GNU GnuTLS 2.12.3
    cpe:2.3:a:gnu:gnutls:2.12.3
  • GNU GnuTLS 2.12.4
    cpe:2.3:a:gnu:gnutls:2.12.4
  • GNU GnuTLS 2.12.5
    cpe:2.3:a:gnu:gnutls:2.12.5
  • GNU GnuTLS 2.6.0
    cpe:2.3:a:gnu:gnutls:2.6.0
  • GNU GnuTLS 2.4.0
    cpe:2.3:a:gnu:gnutls:2.4.0
  • GNU GnuTLS 2.6.2
    cpe:2.3:a:gnu:gnutls:2.6.2
  • GNU GnuTLS 2.6.3
    cpe:2.3:a:gnu:gnutls:2.6.3
  • GNU GnuTLS 2.6.4
    cpe:2.3:a:gnu:gnutls:2.6.4
  • GNU GnuTLS 2.6.5
    cpe:2.3:a:gnu:gnutls:2.6.5
  • GNU GnuTLS 2.4.2
    cpe:2.3:a:gnu:gnutls:2.4.2
  • GNU GnuTLS 2.4.1
    cpe:2.3:a:gnu:gnutls:2.4.1
  • GNU GnuTLS 2.6.6
    cpe:2.3:a:gnu:gnutls:2.6.6
  • GNU GnuTLS 2.8.0
    cpe:2.3:a:gnu:gnutls:2.8.0
  • GNU GnuTLS 2.8.1
    cpe:2.3:a:gnu:gnutls:2.8.1
  • GNU GnuTLS 2.12.16
    cpe:2.3:a:gnu:gnutls:2.12.16
  • GNU GnuTLS 2.6.1
    cpe:2.3:a:gnu:gnutls:2.6.1
  • GNU GnuTLS 2.12.17
    cpe:2.3:a:gnu:gnutls:2.12.17
  • GNU GnuTLS 2.7.4
    cpe:2.3:a:gnu:gnutls:2.7.4
  • GNU GnuTLS 2.12.15
    cpe:2.3:a:gnu:gnutls:2.12.15
  • GNU GnuTLS 2.3.11
    cpe:2.3:a:gnu:gnutls:2.3.11
  • GNU GnuTLS 2.12.6.1
    cpe:2.3:a:gnu:gnutls:2.12.6.1
  • GNU GnuTLS 2.12.6
    cpe:2.3:a:gnu:gnutls:2.12.6
  • GNU GnuTLS 2.12.7
    cpe:2.3:a:gnu:gnutls:2.12.7
  • GNU GnuTLS 2.12.8
    cpe:2.3:a:gnu:gnutls:2.12.8
  • GNU GnuTLS 2.12.9
    cpe:2.3:a:gnu:gnutls:2.12.9
  • GNU GnuTLS 2.12.10
    cpe:2.3:a:gnu:gnutls:2.12.10
  • GNU GnuTLS 2.12.11
    cpe:2.3:a:gnu:gnutls:2.12.11
  • GNU GnuTLS 2.12.12
    cpe:2.3:a:gnu:gnutls:2.12.12
  • GNU GnuTLS 2.12.13
    cpe:2.3:a:gnu:gnutls:2.12.13
  • GNU GnuTLS 2.4.3
    cpe:2.3:a:gnu:gnutls:2.4.3
  • GNU GnuTLS 2.8.2
    cpe:2.3:a:gnu:gnutls:2.8.2
  • GNU GnuTLS 2.8.3
    cpe:2.3:a:gnu:gnutls:2.8.3
  • GNU GnuTLS 2.8.4
    cpe:2.3:a:gnu:gnutls:2.8.4
  • GNU GnuTLS 2.8.5
    cpe:2.3:a:gnu:gnutls:2.8.5
  • GNU GnuTLS 2.8.6
    cpe:2.3:a:gnu:gnutls:2.8.6
  • GNU GnuTLS 2.10.0
    cpe:2.3:a:gnu:gnutls:2.10.0
  • GNU GnuTLS 2.10.1
    cpe:2.3:a:gnu:gnutls:2.10.1
  • GNU GnuTLS 2.10.2
    cpe:2.3:a:gnu:gnutls:2.10.2
  • GNU GnuTLS 2.10.3
    cpe:2.3:a:gnu:gnutls:2.10.3
  • GNU GnuTLS 2.10.4
    cpe:2.3:a:gnu:gnutls:2.10.4
  • GNU GnuTLS 2.10.5
    cpe:2.3:a:gnu:gnutls:2.10.5
  • GNU GnuTLS 2.2.2
    cpe:2.3:a:gnu:gnutls:2.2.2
  • GNU GnuTLS 2.2.1
    cpe:2.3:a:gnu:gnutls:2.2.1
  • GNU GnuTLS 2.2.0
    cpe:2.3:a:gnu:gnutls:2.2.0
  • GNU GnuTLS 2.12.14
    cpe:2.3:a:gnu:gnutls:2.12.14
  • GNU GnuTLS 2.0.4
    cpe:2.3:a:gnu:gnutls:2.0.4
  • GNU GnuTLS 2.2.5
    cpe:2.3:a:gnu:gnutls:2.2.5
  • GNU GnuTLS 2.2.4
    cpe:2.3:a:gnu:gnutls:2.2.4
  • GNU GnuTLS 2.2.3
    cpe:2.3:a:gnu:gnutls:2.2.3
  • GNU GnuTLS 2.0.2
    cpe:2.3:a:gnu:gnutls:2.0.2
  • GNU GnuTLS 2.0.3
    cpe:2.3:a:gnu:gnutls:2.0.3
  • GNU GnuTLS 2.0.0
    cpe:2.3:a:gnu:gnutls:2.0.0
  • GNU GnuTLS 2.0.1
    cpe:2.3:a:gnu:gnutls:2.0.1
  • GNU GnuTLS 2.1.2
    cpe:2.3:a:gnu:gnutls:2.1.2
  • GNU GnuTLS 2.1.3
    cpe:2.3:a:gnu:gnutls:2.1.3
  • GNU GnuTLS 2.1.0
    cpe:2.3:a:gnu:gnutls:2.1.0
  • GNU GnuTLS 2.1.1
    cpe:2.3:a:gnu:gnutls:2.1.1
  • GNU GnuTLS 2.1.7
    cpe:2.3:a:gnu:gnutls:2.1.7
  • GNU GnuTLS 2.1.6
    cpe:2.3:a:gnu:gnutls:2.1.6
  • GNU GnuTLS 2.1.5
    cpe:2.3:a:gnu:gnutls:2.1.5
  • GNU GnuTLS 2.1.4
    cpe:2.3:a:gnu:gnutls:2.1.4
  • GNU GnuTLS 2.3.2
    cpe:2.3:a:gnu:gnutls:2.3.2
  • GNU GnuTLS 2.3.1
    cpe:2.3:a:gnu:gnutls:2.3.1
  • GNU GnuTLS 2.3.0
    cpe:2.3:a:gnu:gnutls:2.3.0
  • GNU GnuTLS 2.1.8
    cpe:2.3:a:gnu:gnutls:2.1.8
  • GNU GnuTLS 2.3.6
    cpe:2.3:a:gnu:gnutls:2.3.6
  • GNU GnuTLS 2.3.5
    cpe:2.3:a:gnu:gnutls:2.3.5
  • GNU GnuTLS 2.3.4
    cpe:2.3:a:gnu:gnutls:2.3.4
  • GNU GnuTLS 2.3.3
    cpe:2.3:a:gnu:gnutls:2.3.3
  • GNU GnuTLS 2.3.10
    cpe:2.3:a:gnu:gnutls:2.3.10
  • GNU GnuTLS 2.3.9
    cpe:2.3:a:gnu:gnutls:2.3.9
  • GNU GnuTLS 2.3.8
    cpe:2.3:a:gnu:gnutls:2.3.8
  • GNU GnuTLS 2.3.7
    cpe:2.3:a:gnu:gnutls:2.3.7
  • GNU GnuTLS 2.12.18
    cpe:2.3:a:gnu:gnutls:2.12.18
  • GNU GnuTLS 2.12.22
    cpe:2.3:a:gnu:gnutls:2.12.22
  • GNU GnuTLS 2.12.21
    cpe:2.3:a:gnu:gnutls:2.12.21
  • GNU GnuTLS 2.12.20
    cpe:2.3:a:gnu:gnutls:2.12.20
  • GNU GnuTLS 2.12.19
    cpe:2.3:a:gnu:gnutls:2.12.19
  • GNU GnuTLS 3.0.14
    cpe:2.3:a:gnu:gnutls:3.0.14
  • GNU GnuTLS 3.0.12
    cpe:2.3:a:gnu:gnutls:3.0.12
  • GNU GnuTLS 3.0.13
    cpe:2.3:a:gnu:gnutls:3.0.13
  • GNU GnuTLS 3.0.11
    cpe:2.3:a:gnu:gnutls:3.0.11
  • GNU GnuTLS 3.0.15
    cpe:2.3:a:gnu:gnutls:3.0.15
  • GNU GnuTLS 3.0.16
    cpe:2.3:a:gnu:gnutls:3.0.16
  • GNU GnuTLS 3.0.0
    cpe:2.3:a:gnu:gnutls:3.0.0
  • GNU GnuTLS 3.0.1
    cpe:2.3:a:gnu:gnutls:3.0.1
  • GNU GnuTLS 3.0.2
    cpe:2.3:a:gnu:gnutls:3.0.2
  • GNU GnuTLS 3.0.3
    cpe:2.3:a:gnu:gnutls:3.0.3
  • GNU GnuTLS 3.0.4
    cpe:2.3:a:gnu:gnutls:3.0.4
  • GNU GnuTLS 3.0.5
    cpe:2.3:a:gnu:gnutls:3.0.5
  • GNU GnuTLS 3.0.6
    cpe:2.3:a:gnu:gnutls:3.0.6
  • GNU TLS 3.0
    cpe:2.3:a:gnu:gnutls:3.0
  • GNU GnuTLS 3.0.9
    cpe:2.3:a:gnu:gnutls:3.0.9
  • GNU GnuTLS 3.0.8
    cpe:2.3:a:gnu:gnutls:3.0.8
  • GNU GnuTLS 3.0.7
    cpe:2.3:a:gnu:gnutls:3.0.7
  • GNU GnuTLS 3.0.10
    cpe:2.3:a:gnu:gnutls:3.0.10
  • GNU GnuTLS 3.0.17
    cpe:2.3:a:gnu:gnutls:3.0.17
  • GNU GnuTLS 3.0.18
    cpe:2.3:a:gnu:gnutls:3.0.18
  • GNU GnuTLS 3.0.19
    cpe:2.3:a:gnu:gnutls:3.0.19
  • GNU GnuTLS 3.0.20
    cpe:2.3:a:gnu:gnutls:3.0.20
  • GNU GnuTLS 3.0.21
    cpe:2.3:a:gnu:gnutls:3.0.21
  • GNU GnuTLS 3.0.22
    cpe:2.3:a:gnu:gnutls:3.0.22
  • GNU GnuTLS 3.0.23
    cpe:2.3:a:gnu:gnutls:3.0.23
  • GNU GnuTLS 3.0.24
    cpe:2.3:a:gnu:gnutls:3.0.24
  • GNU GnuTLS 3.0.25
    cpe:2.3:a:gnu:gnutls:3.0.25
  • GNU GnuTLS 3.0.26
    cpe:2.3:a:gnu:gnutls:3.0.26
  • GNU GnuTLS 3.0.27
    cpe:2.3:a:gnu:gnutls:3.0.27
  • GNU GnuTLS 3.1.0
    cpe:2.3:a:gnu:gnutls:3.1.0
  • GNU GnuTLS 3.1.1
    cpe:2.3:a:gnu:gnutls:3.1.1
  • GNU GnuTLS 3.1.2
    cpe:2.3:a:gnu:gnutls:3.1.2
  • GNU GnuTLS 3.1.3
    cpe:2.3:a:gnu:gnutls:3.1.3
  • GNU GnuTLS 3.1.4
    cpe:2.3:a:gnu:gnutls:3.1.4
  • GNU GnuTLS 3.1.5
    cpe:2.3:a:gnu:gnutls:3.1.5
  • GNU GnuTLS 3.1.6
    cpe:2.3:a:gnu:gnutls:3.1.6
CVSS
Base: 4.0 (as of 11-02-2013 - 10:39)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
nessus via4
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-0636.NASL
    description An updated rhev-hypervisor6 package that fixes several security issues and various bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. A flaw was found in the way QEMU-KVM emulated the e1000 network interface card when the host was configured to accept jumbo network frames, and a guest using the e1000 emulated driver was not. A remote attacker could use this flaw to crash the guest or, potentially, execute arbitrary code with root privileges in the guest. (CVE-2012-6075) It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619) It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL or DTLS server as a padding oracle. (CVE-2013-0169) A NULL pointer dereference flaw was found in the OCSP response verification in OpenSSL. A malicious OCSP server could use this flaw to crash applications performing OCSP verification by sending a specially crafted response. (CVE-2013-0166) It was discovered that the TLS/SSL protocol could leak information about plain text when optional compression was used. An attacker able to control part of the plain text sent over an encrypted TLS/SSL connection could possibly use this flaw to recover other portions of the plain text. (CVE-2012-4929) This updated package provides updated components that include fixes for various security issues. These issues have no security impact on Red Hat Enterprise Virtualization Hypervisor itself, however. The security fixes included in this update address the following CVE numbers : CVE-2013-0292 (dbus-glib issue) CVE-2013-0228, CVE-2013-0268, and CVE-2013-0871 (kernel issues) CVE-2013-0338 (libxml2 issue) This update contains the builds from the following errata : ovirt-node: RHBA-2013:0634 https://rhn.redhat.com/errata/RHBA-2013-0634.html kernel: RHSA-2013:0630 https://rhn.redhat.com/errata/RHSA-2013-0630.html dbus-glib: RHSA-2013:0568 https://rhn.redhat.com/errata/RHSA-2013-0568.html libcgroup: RHBA-2013:0560 https://rhn.redhat.com/errata/RHBA-2013-0560.html vdsm: RHBA-2013:0635 https://rhn.redhat.com/errata/RHBA-2013-0635.html selinux-policy: RHBA-2013:0618 https://rhn.redhat.com/errata/RHBA-2013-0618.html qemu-kvm-rhev: RHSA-2013:0610 https://rhn.redhat.com/errata/RHSA-2013-0610.html glusterfs: RHBA-2013:0620 https://rhn.redhat.com/errata/RHBA-2013-0620.html gnutls: RHSA-2013:0588 https://rhn.redhat.com/errata/RHSA-2013-0588.html ipmitool: RHBA-2013:0572 https://rhn.redhat.com/errata/RHBA-2013-0572.html libxml2: RHSA-2013:0581 https://rhn.redhat.com/errata/RHSA-2013-0581.html openldap: RHBA-2013:0598 https://rhn.redhat.com/errata/RHBA-2013-0598.html openssl: RHSA-2013:0587 https://rhn.redhat.com/errata/RHSA-2013-0587.html Users of the Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which fixes these issues.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 78952
    published 2014-11-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78952
    title RHEL 6 : rhev-hypervisor6 (RHSA-2013:0636)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2015-0101.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2015-0282 (#1198159) - fix CVE-2015-0294 (#1198159) - Corrected value initialization in mpi printing (#1129241) - Check for expiry information in the CA certificates (#1159778) - fix issue with integer padding in certificates and keys (#1036385) - fix session ID length check (#1102025) - fix CVE-2014-0092 (#1069891) - fix CVE-2013-2116 - fix DoS regression in (CVE-2013-1619) upstream patch (#966754) - fix CVE-2013-1619 - fix TLS-CBC timing attack (#908238)
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 85142
    published 2015-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85142
    title OracleVM 3.3 : gnutls (OVMSA-2015-0101)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20130530_GNUTLS_ON_SL5_X.NASL
    description It was discovered that the fix for the CVE-2013-1619 issue released via SLSA-2013:0588 introduced a regression in the way GnuTLS decrypted TLS/SSL encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to crash a server or client application that uses GnuTLS. (CVE-2013-2116) For the update to take effect, all applications linked to the GnuTLS library must be restarted.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 66708
    published 2013-05-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66708
    title Scientific Linux Security Update : gnutls on SL5.x, SL6.x i386/srpm/x86_64
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201310-18.NASL
    description The remote host is affected by the vulnerability described in GLSA-201310-18 (GnuTLS: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers and Lucky Thirteen research paper referenced below for details. Impact : A remote attacker could sent a specially crafted packet to cause a Denial of Service condition. Additionally, a remote attacker could perform man-in-the-middle attacks to recover plaintext data. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 70674
    published 2013-10-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70674
    title GLSA-201310-18 : GnuTLS: Multiple vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-2984.NASL
    description Minor security and bugfix update from upstream. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 65234
    published 2013-03-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65234
    title Fedora 17 : gnutls-2.12.23-1.fc17 / libtasn1-2.14-1.fc17 (2013-2984)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20130304_GNUTLS_ON_SL5_X.NASL
    description It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619) For the update to take effect, all applications linked to the GnuTLS library must be restarted, or the system rebooted.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 65019
    published 2013-03-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65019
    title Scientific Linux Security Update : gnutls on SL5.x, SL6.x i386/x86_64
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-428.NASL
    description Changes in gnutls : - Fix bug[ bnc#802651] CVE-2013-1619( gnutls): Luck-13 issue Add patch file: CVE-2013-1619.patch
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75001
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75001
    title openSUSE Security Update : gnutls (openSUSE-SU-2013:0807-1)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2013-242-01.NASL
    description New gnutls packages are available for Slackware 14.0, and -current to fix a security issue.
    last seen 2019-02-21
    modified 2013-09-27
    plugin id 69519
    published 2013-09-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69519
    title Slackware 14.0 / current : gnutls (SSA:2013-242-01)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-0588.NASL
    description From Red Hat Security Advisory 2013:0588 : Updated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619) Users of GnuTLS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all applications linked to the GnuTLS library must be restarted, or the system rebooted.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68769
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68769
    title Oracle Linux 5 / 6 : gnutls (ELSA-2013-0588)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-2110.NASL
    description - Update to 2.12.22. - Applied patches for CVE-2013-1619. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 64651
    published 2013-02-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64651
    title Fedora 18 : mingw-gnutls-2.12.22-1.fc18 (2013-2110)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2013-287-03.NASL
    description New gnutls packages are available for Slackware 12.1, 12.2, 13.0, 13.1, and 13.37 to fix security issues.
    last seen 2019-02-21
    modified 2013-10-16
    plugin id 70439
    published 2013-10-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70439
    title Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 : gnutls (SSA:2013-287-03)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2013-242-03.NASL
    description New gnutls packages are available for Slackware 14.0 and -current to fix a security issue. Sorry about having to reissue this one -- I pulled it from ftp.gnu.org not realizing that the latest version there was actually months out of date.
    last seen 2019-02-21
    modified 2013-09-27
    plugin id 69521
    published 2013-09-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69521
    title Slackware 14.0 / current : gnutls (SSA:2013-242-03)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2013-197.NASL
    description It was discovered that the fix for the CVE-2013-1619 issue introduced a regression in the way GnuTLS decrypted TLS/SSL encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to crash a server or client application that uses GnuTLS. (CVE-2013-2116)
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 69755
    published 2013-09-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69755
    title Amazon Linux AMI : gnutls (ALAS-2013-197)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-2892.NASL
    description Minor security and bugfix update from upstream. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 65036
    published 2013-03-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65036
    title Fedora 18 : gnutls-2.12.23-1.fc18 (2013-2892)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1752-1.NASL
    description Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used in GnuTLS was vulnerable to a timing side-channel attack known as the 'Lucky Thirteen' issue. A remote attacker could use this issue to perform plaintext-recovery attacks via analysis of timing data. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 64928
    published 2013-02-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64928
    title Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : gnutls13, gnutls26 vulnerability (USN-1752-1)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2013-040.NASL
    description Nadhem Alfardan and Kenny Paterson devised an attack that recovers some bits of the plaintext of a GnuTLS session that utilizes that CBC ciphersuites, by using timing information (CVE-2013-1619). The gnutls package has been updated to latest 3.0.28 version to fix above problem.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 66054
    published 2013-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66054
    title Mandriva Linux Security Advisory : gnutls (MDVSA-2013:040)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_GNUTLS-8554.NASL
    description This GnuTLS update fixes incorrect padding which weakens the encryption. CVE-2013-1619 has been assigned to this issue.
    last seen 2019-02-21
    modified 2013-05-01
    plugin id 66289
    published 2013-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66289
    title SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 8554)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_GNUTLS-130424.NASL
    description This GnuTLS update fixes incorrect padding which weakens the encryption. CVE-2013-1619 has been assigned to this issue.
    last seen 2019-02-21
    modified 2013-10-25
    plugin id 66287
    published 2013-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66287
    title SuSE 11.2 Security Update : GnuTLS (SAT Patch Number 7660)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-2128.NASL
    description - Update to 2.12.20. - Apply patches for CVE-2013-1619. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 64664
    published 2013-02-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64664
    title Fedora 17 : mingw-gnutls-2.12.20-1.fc17 (2013-2128)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-0588.NASL
    description Updated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619) Users of GnuTLS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all applications linked to the GnuTLS library must be restarted, or the system rebooted.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 65032
    published 2013-03-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65032
    title CentOS 5 / 6 : gnutls (CESA-2013:0588)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-0588.NASL
    description Updated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619) Users of GnuTLS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all applications linked to the GnuTLS library must be restarted, or the system rebooted.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 65005
    published 2013-03-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65005
    title RHEL 5 / 6 : gnutls (RHSA-2013:0588)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2013-172.NASL
    description It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619)
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 69731
    published 2013-09-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69731
    title Amazon Linux AMI : gnutls (ALAS-2013-172)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS11_GNUTLS_20130924.NASL
    description The remote Solaris system is missing necessary patches to address security updates : - The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. (CVE-2013-1619) - The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169. (CVE-2013-2116)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 80630
    published 2015-01-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80630
    title Oracle Solaris Third-Party Patch Update : gnutls (cve_2013_1619_cryptographic_issues)
redhat via4
advisories
bugzilla
id 908238
title CVE-2013-1619 gnutls: TLS CBC padding timing attack (lucky-13)
oval
OR
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment gnutls is earlier than 0:1.4.1-10.el5_9.1
          oval oval:com.redhat.rhsa:tst:20130588002
        • comment gnutls is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080489003
      • AND
        • comment gnutls-devel is earlier than 0:1.4.1-10.el5_9.1
          oval oval:com.redhat.rhsa:tst:20130588006
        • comment gnutls-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080489005
      • AND
        • comment gnutls-utils is earlier than 0:1.4.1-10.el5_9.1
          oval oval:com.redhat.rhsa:tst:20130588004
        • comment gnutls-utils is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080489007
  • AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    • OR
      • AND
        • comment gnutls is earlier than 0:2.8.5-10.el6_4.1
          oval oval:com.redhat.rhsa:tst:20130588012
        • comment gnutls is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20120429006
      • AND
        • comment gnutls-devel is earlier than 0:2.8.5-10.el6_4.1
          oval oval:com.redhat.rhsa:tst:20130588016
        • comment gnutls-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20120429010
      • AND
        • comment gnutls-guile is earlier than 0:2.8.5-10.el6_4.1
          oval oval:com.redhat.rhsa:tst:20130588018
        • comment gnutls-guile is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20120429012
      • AND
        • comment gnutls-utils is earlier than 0:2.8.5-10.el6_4.1
          oval oval:com.redhat.rhsa:tst:20130588014
        • comment gnutls-utils is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20120429008
rhsa
id RHSA-2013:0588
released 2013-03-04
severity Moderate
title RHSA-2013:0588: gnutls security update (Moderate)
rpms
  • gnutls-0:1.4.1-10.el5_9.1
  • gnutls-devel-0:1.4.1-10.el5_9.1
  • gnutls-utils-0:1.4.1-10.el5_9.1
  • gnutls-0:2.8.5-10.el6_4.1
  • gnutls-devel-0:2.8.5-10.el6_4.1
  • gnutls-guile-0:2.8.5-10.el6_4.1
  • gnutls-utils-0:2.8.5-10.el6_4.1
refmap via4
confirm
misc http://www.isg.rhul.ac.uk/tls/TLStiming.pdf
mlist [oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations
secunia
  • 57260
  • 57274
suse
  • SUSE-SU-2014:0320
  • SUSE-SU-2014:0322
  • openSUSE-SU-2013:0807
  • openSUSE-SU-2014:0346
ubuntu USN-1752-1
Last major update 26-03-2014 - 00:46
Published 08-02-2013 - 14:55
Back to Top