Test ID:	1.3.6.1.4.1.25623.1.0.891518
Category:	Debian Local Security Checks
Title:	Debian LTS: Security Advisory for polarssl (DLA-1518-1)
Summary:	Two vulnerabilities were discovered in polarssl, a lightweight crypto and;SSL/TLS library (nowadays continued under the name mbedtls) which could;result in plain text recovery via side-channel attacks.;;Two other minor vulnerabilities were discovered in polarssl which could;result in arithmetic overflow errors.;;CVE-2018-0497;;As a protection against the Lucky Thirteen attack, the TLS code for;CBC decryption in encrypt-then-MAC mode performs extra MAC;calculations to compensate for variations in message size due to;padding. The amount of extra MAC calculation to perform was based on;the assumption that the bulk of the time is spent in processing;64-byte blocks, which is correct for most supported hashes but not for;SHA-384. Correct the amount of extra work for SHA-384 (and SHA-512;which is currently not used in TLS, and MD2 although no one should;care about that).;;This is a regression fix for what CVE-2013-0169 had been fixed this.;;CVE-2018-0498;;The basis for the Lucky 13 family of attacks is for an attacker to be;able to distinguish between (long) valid TLS-CBC padding and invalid;TLS-CBC padding. Since our code sets padlen = 0 for invalid padding,;the length of the input to the HMAC function gives information about;that.;;Information about this length (modulo the MD/SHA block size) can be;deduced from how much MD/SHA padding (this is distinct from TLS-CBC;padding) is used. If MD/SHA padding is read from a (static) buffer, a;local attacker could get information about how much is used via a;cache attack targeting that buffer.;;Let's get rid of this buffer. Now the only buffer used is the;internal MD/SHA one, which is always read fully by the process();function.;;CVE-2018-9988;;Prevent arithmetic overflow on bounds check and add bound check;before signature length read in ssl_parse_server_key_exchange().;;CVE-2018-9989;;Prevent arithmetic overflow on bounds check and add bound check;before length read in ssl_parse_server_psk_hint()
Description:	Summary: Two vulnerabilities were discovered in polarssl, a lightweight crypto and SSL/TLS library (nowadays continued under the name mbedtls) which could result in plain text recovery via side-channel attacks. Two other minor vulnerabilities were discovered in polarssl which could result in arithmetic overflow errors. CVE-2018-0497 As a protection against the Lucky Thirteen attack, the TLS code for CBC decryption in encrypt-then-MAC mode performs extra MAC calculations to compensate for variations in message size due to padding. The amount of extra MAC calculation to perform was based on the assumption that the bulk of the time is spent in processing 64-byte blocks, which is correct for most supported hashes but not for SHA-384. Correct the amount of extra work for SHA-384 (and SHA-512 which is currently not used in TLS, and MD2 although no one should care about that). This is a regression fix for what CVE-2013-0169 had been fixed this. CVE-2018-0498 The basis for the Lucky 13 family of attacks is for an attacker to be able to distinguish between (long) valid TLS-CBC padding and invalid TLS-CBC padding. Since our code sets padlen = 0 for invalid padding, the length of the input to the HMAC function gives information about that. Information about this length (modulo the MD/SHA block size) can be deduced from how much MD/SHA padding (this is distinct from TLS-CBC padding) is used. If MD/SHA padding is read from a (static) buffer, a local attacker could get information about how much is used via a cache attack targeting that buffer. Let's get rid of this buffer. Now the only buffer used is the internal MD/SHA one, which is always read fully by the process() function. CVE-2018-9988 Prevent arithmetic overflow on bounds check and add bound check before signature length read in ssl_parse_server_key_exchange(). CVE-2018-9989 Prevent arithmetic overflow on bounds check and add bound check before length read in ssl_parse_server_psk_hint() Affected Software/OS: polarssl on Debian Linux Solution: For Debian 8 'Jessie', these problems have been fixed in version 1.3.9-2.1+deb8u4. We recommend that you upgrade your polarssl packages. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-0169 http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html BugTraq ID: 57778 http://www.securityfocus.com/bid/57778 Cert/CC Advisory: TA13-051A http://www.us-cert.gov/cas/techalerts/TA13-051A.html CERT/CC vulnerability note: VU#737740 http://www.kb.cert.org/vuls/id/737740 Debian Security Information: DSA-2621 (Google Search) http://www.debian.org/security/2013/dsa-2621 Debian Security Information: DSA-2622 (Google Search) http://www.debian.org/security/2013/dsa-2622 http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html http://security.gentoo.org/glsa/glsa-201406-32.xml HPdes Security Advisory: HPSBMU02874 http://marc.info/?l=bugtraq&m=136733161405818&w=2 HPdes Security Advisory: HPSBOV02852 http://marc.info/?l=bugtraq&m=136432043316835&w=2 HPdes Security Advisory: HPSBUX02856 http://marc.info/?l=bugtraq&m=136396549913849&w=2 HPdes Security Advisory: HPSBUX02857 http://marc.info/?l=bugtraq&m=136439120408139&w=2 HPdes Security Advisory: HPSBUX02909 http://marc.info/?l=bugtraq&m=137545771702053&w=2 HPdes Security Advisory: SSRT101103 HPdes Security Advisory: SSRT101104 HPdes Security Advisory: SSRT101108 HPdes Security Advisory: SSRT101184 HPdes Security Advisory: SSRT101289 http://www.mandriva.com/security/advisories?name=MDVSA-2013:095 http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/ http://www.isg.rhul.ac.uk/tls/TLStiming.pdf https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html http://openwall.com/lists/oss-security/2013/02/05/24 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18841 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19016 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19424 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19540 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19608 RedHat Security Advisories: RHSA-2013:0587 http://rhn.redhat.com/errata/RHSA-2013-0587.html RedHat Security Advisories: RHSA-2013:0782 http://rhn.redhat.com/errata/RHSA-2013-0782.html RedHat Security Advisories: RHSA-2013:0783 http://rhn.redhat.com/errata/RHSA-2013-0783.html RedHat Security Advisories: RHSA-2013:0833 http://rhn.redhat.com/errata/RHSA-2013-0833.html RedHat Security Advisories: RHSA-2013:1455 http://rhn.redhat.com/errata/RHSA-2013-1455.html RedHat Security Advisories: RHSA-2013:1456 http://rhn.redhat.com/errata/RHSA-2013-1456.html http://www.securitytracker.com/id/1029190 http://secunia.com/advisories/53623 http://secunia.com/advisories/55108 http://secunia.com/advisories/55139 http://secunia.com/advisories/55322 http://secunia.com/advisories/55350 http://secunia.com/advisories/55351 SuSE Security Announcement: SUSE-SU-2013:0328 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html SuSE Security Announcement: SUSE-SU-2013:0701 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html SuSE Security Announcement: SUSE-SU-2014:0320 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html SuSE Security Announcement: SUSE-SU-2015:0578 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html SuSE Security Announcement: openSUSE-SU-2013:0375 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html SuSE Security Announcement: openSUSE-SU-2013:0378 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html SuSE Security Announcement: openSUSE-SU-2016:0640 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html http://www.ubuntu.com/usn/USN-1735-1 Common Vulnerability Exposure (CVE) ID: CVE-2018-0497 Debian Security Information: DSA-4296 (Google Search) https://www.debian.org/security/2018/dsa-4296 https://usn.ubuntu.com/4267-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-0498 Common Vulnerability Exposure (CVE) ID: CVE-2018-9988 Common Vulnerability Exposure (CVE) ID: CVE-2018-9989
Copyright	Copyright (C) 2018 Greenbone Networks GmbH http://greenbone.net

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.