CVE-2013-1621: Input Validation
Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session, a different vulnerability than CVE-2013-0169.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1621?
CVE-2013-1621 has been categorized as a moderate severity vulnerability, primarily impacting the availability of systems using affected PolarSSL versions.
How do I fix CVE-2013-1621?
To fix CVE-2013-1621, upgrade PolarSSL to version 1.2.5 or later, which resolves the array index error in the SSL module.
What types of attacks can CVE-2013-1621 be exploited for?
CVE-2013-1621 can be exploited to perform denial-of-service attacks by causing a TLS session to fail during CBC padding validation.
Which PolarSSL versions are affected by CVE-2013-1621?
CVE-2013-1621 affects PolarSSL versions prior to 1.2.5, including all versions from 0.10.0 up to 1.2.4.
Is there a workaround for CVE-2013-1621 if I cannot upgrade?
No official workaround is provided for CVE-2013-1621, and upgrading to a patched version is strongly recommended for security.