CVE-2013-1621 Denial of service in n/a
Remote attackers can cause a denial of service in PolarSSL via crafted CBC padding values during TLS session validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1621?
CVE-2013-1621 is a medium-severity denial of service vulnerability in n/a, published on 8 Feb 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session, a different vulnerability than CVE-2013-0169.
Weakness: CWE-20
Which versions are affected by CVE-2013-1621?
It affects 1 product.
Products include Polarssl Polarssl.
How do I fix CVE-2013-1621?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2013-1621 being exploited?
There is no known exploitation of CVE-2013-1621 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2011-4574 Weak cryptography in PolarSSL
- CVE-2014-8628 Denial of service in n/a
- CVE-2013-5914 Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow remote attackers to e
- CVE-2014-8627 Security feature bypass in n/a
- CVE-2013-5915 Information disclosure in n/a
Sources
Also known as GHSA-pvmj-2j9v-f5w6.