The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys.

- Update to 1.2.10

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been discovered in PolarSSL, a lightweight crypto and SSL/TLS library :

  - CVE-2013-4623     Jack Lloyd discovered a denial of service vulnerability     in the parsing of PEM-encoded certificates.

  - CVE-2013-5914     Paul Brodeur and TrustInSoft discovered a buffer     overflow in the ssl_read_record() function, allowing the     potential execution of arbitrary code.

  - CVE-2013-5915     Cyril Arnaud and Pierre-Alain Fouque discovered timing     attacks against the RSA implementation.

The remote host is affected by the vulnerability described in GLSA-201310-10 (PolarSSL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PolarSSL. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker might be able to cause Denial of Service, conduct a       man-in-the middle attack, compromise an encrypted communication channel,       or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Bugfix release fixing CVE-2013-5915, https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

PolarSSL Project reports :

The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount an attack on the RSA key. Although their test attack is done on a local system, there seems to be enough indication that this can properly be performed from a remote system as well.

All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected if a third party can send arbitrary handshake messages to your server.

If correctly executed, this attack reveals the entire private RSA key after a large number of attack messages (> 600.000 on a local machine) are sent to show the timing differences.

ID	Name	Product	Family	Severity
76153	Fedora 20 : polarssl-1.2.10-2.fc20 (2014-7263)	Nessus	Fedora Local Security Checks	medium
76152	Fedora 19 : polarssl-1.2.10-2.fc19 (2014-7261)	Nessus	Fedora Local Security Checks	medium
70533	Debian DSA-2782-1 : polarssl - several vulnerabilities	Nessus	Debian Local Security Checks	medium
70486	GLSA-201310-10 : PolarSSL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
70420	Fedora 18 : polarssl-1.2.9-1.fc18 (2013-18251)	Nessus	Fedora Local Security Checks	medium
70419	Fedora 19 : polarssl-1.2.9-1.fc19 (2013-18228)	Nessus	Fedora Local Security Checks	medium
70377	Fedora 20 : polarssl-1.2.9-1.fc20 (2013-18216)	Nessus	Fedora Local Security Checks	medium
70264	FreeBSD : polarssl -- Timing attack against protected RSA-CRT implementation (ccefac3e-2aed-11e3-af10-000c29789cb5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-5915

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium