CVE-2013-1620

Description

The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

Affected packages (1)

• Debian/nssfrom 0, < 2:3.14.3-1

References (1)

• ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2013-1620