Vulnerability Intelligence Report
CVE-2013-1620
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
No Active Exploit Signals
CVSS Base Score
4.3
MEDIUM
EPSS Probability:3.72%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| mozilla | network_security_services | all |
| canonical | ubuntu_linux | 10.04, 11.10, 12.04, 12.10 |
| oracle | enterprise_manager_ops_center | 11.1, 12.1, 12.2 |
| oracle | glassfish_communications_server | 2.0 |
| oracle | glassfish_server | 2.1.1 |
| oracle | iplanet_web_proxy_server | 4.0 |
| oracle | iplanet_web_server | 6.1, 7.0 |
| oracle | opensso | 3.0-03 |
| oracle | traffic_director | 11.1.1.6.0, 11.1.1.7.0 |
| oracle | vm_server | 3.2 |
| redhat | enterprise_linux_desktop | 5.0, 6.0 |
| redhat | enterprise_linux_eus | 5.9 |
| redhat | enterprise_linux_server | 5.0, 6.0 |
| redhat | enterprise_linux_server_aus | 5.9 |
| redhat | enterprise_linux_workstation | 5.0, 6.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
3.723%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2013-02-05T00:00:00 |
| Published | 2013-02-08T19:00:00 |
| Patch Date | 2013-02-05 |
| Last Updated | 2024-08-06T15:04:49 |
Community Chatter & Buzz