CVE Feed

    Dashboard / CVE / CVE-2013-5915

    CVE-2013-5915

    The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys.

    Published:Oct 4, 2013
    Last Modified:Apr 11, 2025
    EPS:Oct 4, 2013
    EPSS Score:0.00688
    CVSS Score:4.3

    Affected Products

    Vendor
    Polarssl
    Product
    Polarssl

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2011-4574 (CVSS 9.8) — PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses tim…
    CVE-2012-2130 (CVSS 7.4) — A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when …
    CVE-2015-5291 (CVSS 6.8) — Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3…
    CVE-2015-8036 (CVSS 6.8) — Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows…
    CVE-2014-9744 (CVSS 7.8) — Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption)…
    CVE-2014-8628 (CVSS 7.8) — Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of serv…
    CVE-2015-1182 (CVSS 7.5) — The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.…
    CVE-2014-8627 (CVSS 5) — PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to co…
    CVE-2014-4911 (CVSS 5) — The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remo…
    CVE-2013-5914 (CVSS 6.8) — Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, mig…

    References

    http://lists.fedoraproject.org/pipermail/package-announce/2013-October/118758.html
    http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html
    http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119018.html
    http://osvdb.org/98049
    http://secunia.com/advisories/55084
    http://www.debian.org/security/2013/dsa-2782
    http://www.securityfocus.com/bid/62771
    https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05
    http://lists.fedoraproject.org/pipermail/package-announce/2013-October/118758.html
    http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html
    http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119018.html
    http://osvdb.org/98049
    http://secunia.com/advisories/55084
    http://www.debian.org/security/2013/dsa-2782
    http://www.securityfocus.com/bid/62771
    https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High