CVE-2013-4623: Input Validation
From the PolarSSL Security Advisory 2013-03 advisory:
"A bug in the logic of the parsing of PEM encoded certificates in x509parsecrt() can result in an infinite loop, thus hogging processing power."
A remote attacker could use this flaw to make a TLS/SSL server using PolarSSL consume an excessive amount of CPU.
This issue was corrected in PolarSSL versions 1.1.7 and 1.2.8. (Versions prior to these are affected.)
External References:
https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03
Other sources
The x509parsecrt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certificate message that contains a PEM encoded certificate.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4623?
CVE-2013-4623 has a severity rating that indicates it can lead to denial of service due to infinite looping during certificate parsing.
How do I fix CVE-2013-4623?
To fix CVE-2013-4623, upgrade PolarSSL to a version that has addressed the infinite loop bug in x509parse_crt() functionality.
Which PolarSSL versions are affected by CVE-2013-4623?
CVE-2013-4623 affects PolarSSL versions 1.1.0 through 1.2.7 across various release candidates and regular releases.
Can CVE-2013-4623 be exploited remotely?
Yes, CVE-2013-4623 can be exploited by a remote attacker to cause a TLS/SSL server using PolarSSL to consume excessive processing power.
Is there a workaround for CVE-2013-4623?
Currently, the recommended action for CVE-2013-4623 is to update to a patched version of PolarSSL, as no effective workaround exists.