Executive Summary

Summary
Title RSA key reconstruction vulnerability
Informations
Name VU#724968 First vendor Publication 2007-08-01
Vendor VU-CERT Last vendor Modification 2007-08-02
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:H/Au:N/C:P/I:N/A:N)
Cvss Base Score 1.2 Attack Range Local
Cvss Impact Score 2.9 Attack Complexity High
Cvss Expoit Score 1.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#724968

RSA key reconstruction vulnerability

Overview

Various implementations of RSA may contain a vulnerability that could allow an attacker to retrieve encryption keys.

I. Description

Some implementations of RSA may contain a vulnerability that could allow a local attacker to retrieve encryption keys.

OpenSSL is a widely used open source implementation of the SSL and TLS protocols. OpenSSL is based on the SSLeay library. OpenSSL provides support for the RSA encryption algorithm. Note that vendors may include a vulnerable version of OpenSSL in web servers, VPN, or other products.

II. Impact

An attacker could possibly decrypt messages that were encrypted with OpenSSL using RSA algorithm.

III. Solution

Apply a patch

OpenSSL has released a patch to address this issue. See http://openssl.org/news/patch-CVE-2007-3108.txt for more details.

Systems Affected

VendorStatusDate Updated
America Online, Inc.Unknown28-Jun-2007
Apache-SSLUnknown28-Jun-2007
Apache HTTP Server ProjectUnknown28-Jun-2007
Apple Computer, Inc.Unknown1-Aug-2007
Aruba Networks, Inc.Unknown28-Jun-2007
AttachmateWRQ, Inc.Unknown28-Jun-2007
CerticomUnknown28-Jun-2007
Conectiva Inc.Unknown1-Aug-2007
Covalent TechnologiesUnknown28-Jun-2007
Cray Inc.Unknown1-Aug-2007
CryptlibUnknown2-Aug-2007
Crypto++ LibraryUnknown28-Jun-2007
Debian GNU/LinuxUnknown1-Aug-2007
EMC CorporationUnknown1-Aug-2007
Engarde Secure LinuxUnknown1-Aug-2007
F-Secure CorporationUnknown31-Jul-2007
F5 Networks, Inc.Unknown28-Jun-2007
Fedora ProjectUnknown1-Aug-2007
FreeBSD, Inc.Unknown1-Aug-2007
FujitsuUnknown1-Aug-2007
Gentoo LinuxUnknown1-Aug-2007
Hewlett-Packard CompanyUnknown1-Aug-2007
HitachiUnknown1-Aug-2007
IAIK Java GroupUnknown28-Jun-2007
IBM CorporationUnknown1-Aug-2007
IBM Corporation (zseries)Unknown1-Aug-2007
IBM eServerUnknown1-Aug-2007
Immunix Communications, Inc.Unknown1-Aug-2007
Ingrian Networks, Inc.Unknown28-Jun-2007
Juniper Networks, Inc.Unknown1-Aug-2007
Lotus SoftwareUnknown28-Jun-2007
lshUnknown28-Jun-2007
Mandriva, Inc.Unknown1-Aug-2007
Microsoft CorporationUnknown28-Jun-2007
Mirapoint, Inc.Unknown28-Jun-2007
mod_sslUnknown28-Jun-2007
MontaVista Software, Inc.Unknown1-Aug-2007
MozillaUnknown28-Jun-2007
NEC CorporationUnknown1-Aug-2007
NetBSDUnknown1-Aug-2007
Netscape NSSUnknown28-Jun-2007
NokiaUnknown28-Jun-2007
Novell, Inc.Unknown1-Aug-2007
OpenBSDUnknown1-Aug-2007
OpenSSLVulnerable2-Aug-2007
Openwall GNU/*/LinuxUnknown1-Aug-2007
QNX, Software Systems, Inc.Unknown1-Aug-2007
Red Hat, Inc.Unknown1-Aug-2007
RSA Security, Inc.Unknown28-Jun-2007
Silicon Graphics, Inc.Unknown1-Aug-2007
Slackware Linux Inc.Unknown1-Aug-2007
Sony CorporationUnknown1-Aug-2007
SpyrusUnknown28-Jun-2007
StunnelUnknown28-Jun-2007
Sun Microsystems, Inc.Unknown28-Jun-2007
SUSE LinuxUnknown1-Aug-2007
The SCO GroupUnknown1-Aug-2007
Trustix Secure LinuxUnknown1-Aug-2007
TurbolinuxUnknown1-Aug-2007
UbuntuUnknown1-Aug-2007
UnisysUnknown1-Aug-2007
Wind River Systems, Inc.Unknown1-Aug-2007

References


http://openssl.org/news/patch-CVE-2007-3108.txt
http://cvs.openssl.org/chngview?cn=16275
http://www.openssl.org/docs/apps/rsa.html#
http://en.wikipedia.org/wiki/Rsa

Credit

Thanks to Dr. Onur Aciicmez, Samsung Information Systems America, Samsung Electronics R&D Center, USA, and Prof. Werner Schindler, Bundesamt für Sicherheit in der Informationstechnik (BSI), Germany for reporting this vulnerability.

This document was written by Ryan Giobbi.

Other Information

Date Public
Date First Published08/01/2007 11:03:28 AM
Date Last Updated08/02/2007
CERT Advisory 
CVE NameCVE-2007-3108
Metric1.77
Document Revision19

Original Source

Url : http://www.kb.cert.org/vuls/id/724968

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20219
 
Oval ID: oval:org.mitre.oval:def:20219
Title: DSA-1571-1 openssl - predictable random number generator
Description: Luciano Bello discovered that the random number generator in Debian's openssl package is predictable. This is caused by an incorrect Debian-specific change to the openssl package (<a href="http://security-tracker.debian.org/tracker/CVE-2008-0166">CVE-2008-0166</a>). As a result, cryptographic key material may be guessable.
Family: unix Class: patch
Reference(s): DSA-1571-1
CVE-2008-0166
CVE-2007-4995
CVE-2007-3108
 Version: 5
Platform(s): Debian GNU/Linux 4.0
 Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7946
 
Oval ID: oval:org.mitre.oval:def:7946
Title: DSA-1571 openssl -- predictable random number generator
Description: Luciano Bello discovered that the random number generator in Debian's openssl package is predictable. This is caused by an incorrect Debian-specific change to the openssl package (CVE-2008-0166). As a result, cryptographic key material may be guessable. This is a Debian-specific vulnerability which does not affect other operating systems which are not based on Debian. However, other systems can be indirectly affected if weak keys are imported into them. It is strongly recommended that all cryptographic key material which has been generated by OpenSSL versions starting with 0.9.8c-1 on Debian systems is recreated from scratch. Furthermore, all DSA keys ever used on affected Debian systems for signing or authentication purposes should be considered compromised; the Digital Signature Algorithm relies on a secret random value used during signature generation. The first vulnerable version, 0.9.8c-1, was uploaded to the unstable distribution on 2006-09-17, and has since that date propagated to the testing and current stable (etch) distributions. The old stable distribution (sarge) is not affected. Affected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key material for use in X.509 certificates and session keys used in SSL/TLS connections. Keys generated with GnuPG or GNUTLS are not affected, though. A detector for known weak key material will be published at: http://security.debian.org/project/extra/dowkd/dowkd.pl.gz (OpenPGP signature) Instructions how to implement key rollover for various packages will be published at: http://www.debian.org/security/key-rollover/ This web site will be continuously updated to reflect new and updated instructions on key rollovers for packages using SSL certificates. Popular packages not affected will also be listed. In addition to this critical change, two other vulnerabilities have been fixed in the openssl package which were originally scheduled for release with the next etch point release: OpenSSL's DTLS (Datagram TLS, basically SSL over UDP) implementation did not actually implement the DTLS specification, but a potentially much weaker protocol, and contained a vulnerability permitting arbitrary code execution (CVE-2007-4995). A side channel attack in the integer multiplication routines is also addressed (CVE-2007-3108).
Family: unix Class: patch
Reference(s): DSA-1571
CVE-2008-0166
CVE-2007-4995
CVE-2007-3108
 Version: 3
Platform(s): Debian GNU/Linux 4.0
 Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9984
 
Oval ID: oval:org.mitre.oval:def:9984
Title: The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.
Description: The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.
Family: unix Class: vulnerability
Reference(s): CVE-2007-3108
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 254

OpenVAS Exploits

Date Description
2009-04-09 Name : Mandriva Update for openssl MDKSA-2007:193 (openssl)
File : nvt/gb_mandriva_MDKSA_2007_193.nasl
2009-03-23 Name : Ubuntu Update for openssl vulnerabilities USN-522-1
File : nvt/gb_ubuntu_USN_522_1.nasl
2009-02-27 Name : Fedora Update for openssl FEDORA-2007-1444
File : nvt/gb_fedora_2007_1444_openssl_fc7.nasl
2009-02-27 Name : Fedora Update for openssl FEDORA-2007-2530
File : nvt/gb_fedora_2007_2530_openssl_fc7.nasl
2009-02-27 Name : Fedora Update for openssl FEDORA-2007-661
File : nvt/gb_fedora_2007_661_openssl_fc6.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200710-06 (openssl)
File : nvt/glsa_200710_06.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200805-07 (ltsp)
File : nvt/glsa_200805_07.nasl
2008-05-27 Name : Debian Security Advisory DSA 1571-1 (openssl)
File : nvt/deb_1571_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
37055 OpenSSL crypto/bn/bn_mont.c BN_from_montgomery Function Local RSA Key Disclosure

Nessus® Vulnerability Scanner

Date Description
2014-12-15 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201412-11.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL8108.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2007-0964.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2007-0813.nasl - Type : ACT_GATHER_INFO
2013-06-29 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-1003.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20071012_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20071022_openssl_on_SL3.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20071115_openssl_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-01-04 Name : The remote server is affected by multiple vulnerabilities.
File : openssl_0_9_8f.nasl - Type : ACT_GATHER_INFO
2010-01-06 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-0964.nasl - Type : ACT_GATHER_INFO
2009-07-27 Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2008-0013.nasl - Type : ACT_GATHER_INFO
2009-07-27 Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2008-0001.nasl - Type : ACT_GATHER_INFO
2008-08-20 Name : The remote SSH service is affected by multiple vulnerabilities.
File : attachmate_reflection_70_sp1.nasl - Type : ACT_GATHER_INFO
2008-05-13 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1571.nasl - Type : ACT_GATHER_INFO
2007-11-16 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-1003.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-522-1.nasl - Type : ACT_GATHER_INFO
2007-11-06 Name : The remote Fedora host is missing a security update.
File : fedora_2007-1444.nasl - Type : ACT_GATHER_INFO
2007-10-25 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-0813.nasl - Type : ACT_GATHER_INFO
2007-10-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0813.nasl - Type : ACT_GATHER_INFO
2007-10-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0964.nasl - Type : ACT_GATHER_INFO
2007-10-09 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-193.nasl - Type : ACT_GATHER_INFO
2007-10-09 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200710-06.nasl - Type : ACT_GATHER_INFO
2007-08-21 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-661.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2016-04-26 13:55:31
  • Multiple Updates
2014-02-17 12:08:08
  • Multiple Updates