TLS Protocol CVE-2013-3587 Information Disclosure Vulnerability

Bugtraq ID:	62618
Class:	Design Error
CVE:	CVE-2013-3587
Remote:	Yes
Local:	No
Published:	Aug 01 2013 12:00AM
Updated:	Aug 01 2013 12:00AM
Credit:	Angelo Pradoof Salesforce.com, Neal Harris of Square and Yoel Gluck of Salesforce.com
Vulnerable:	IETF TLS 1.2
Not Vulnerable:

TLS Protocol CVE-2013-3587 Information Disclosure Vulnerability

TLS protocol is prone to an information-disclosure vulnerability.

A man-in-the-middle attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

TLS Protocol CVE-2013-3587 Information Disclosure Vulnerability

Attackers can use readily available tools to exploit this issue.

TLS Protocol CVE-2013-3587 Information Disclosure Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TLS Protocol CVE-2013-3587 Information Disclosure Vulnerability

References:

• Bug 995168 - (BREACH, CVE-2013-3587) CVE-2013-3587 BREACH attack against HTTP co (Red Hat Bugzilla)
  
• BREACH vulnerability in compressed HTTPS (US-CERT)
  
• The Transport Layer Security (TLS) Protocol Version 1.2 (IETF)