Bug 772132 (CVE-2012-0390)

http://www.isg.rhul.ac.uk/~kp/dtls.pdf

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain
error-handling code only if there is a specific relationship between a
padding length and the ciphertext size, which makes it easier for
remote attackers to recover partial plaintext via a timing
side-channel attack, a related issue to CVE-2011-4108.

-----
Abstract from the paper:
-----

The Datagram Transport Layer Security (DTLS) proto-
col provides confidentiality and integrity of data exchanged
between a client and a server. We describe an efficient and
full plaintext recovery attack against the OpenSSL imple-
mentation of DTLS, and a partial plaintext recovery attack
against the GnuTLS implementation of DTLS. The attack
against the OpenSSL implementation is a variant of Vaude-
nay’s padding oracle attack and exploits small timing differ-
ences arising during the cryptographic processing of DTLS
packets. It would have been prevented if the OpenSSL im-
plementation had been in accordance with the DTLS RFC.
In contrast, the GnuTLS implementation does follow the
DTLS RFC closely, but is still vulnerable to attack. The
attacks require new insights to overcome the lack of error
messages in DTLS and to amplify the timing differences. We
discuss the reasons why these implementations are insecure,
drawing lessons for secure protocol design and implemen-
tation in general.