Executive Summary
| Summary | |
|---|---|
| Title | Updated OpenSSL packages fix vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2003:102 | First vendor Publication | 2003-03-31 |
| Vendor | RedHat | Last vendor Modification | 2003-03-31 |
| Severity (Vendor) | N/A | Revision | 02 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2003-102.html |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:461 | |||
| Oval ID: | oval:org.mitre.oval:def:461 | ||
| Title: | Klima-Pokorny-Rosa Attack Vulnerability | ||
| Description: | The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack." | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2003-0131 | Version: | 2 |
| Platform(s): | Red Hat Linux 9 | Product(s): | OpenSSL |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:466 | |||
| Oval ID: | oval:org.mitre.oval:def:466 | ||
| Title: | OpenSSL No RSA Blinding Vulnerability | ||
| Description: | OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal). | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2003-0147 | Version: | 2 |
| Platform(s): | Red Hat Linux 9 | Product(s): | OpenSSL |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-05-05 | Name : HP-UX Update for ApacheStrong HPSBUX00255 File : nvt/gb_hp_ux_HPSBUX00255.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 288-1 (openssl) File : nvt/deb_288_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 3948 | Multiple SSL/TLS Implementation Non-RSA Blinding Private Key Disclosure Multiple SSL/TLS implementations contain a flaw that may allow a malicious user to recover the RSA secret. It is possible that the flaw may allow an attacker to guess the private key. resulting in a loss of confidentiality, integrity, and/or availability. |
| 3947 | OpenSSL Non-RSA Blinding Private Key Disclosure OpenSSL contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered because RSA blinding is not enabled by default, which will disclose private key information resulting in a loss of confidentiality. |
| 3946 | OpenSSL RSA Klima-Pokorny-Rosa Attack OpenSSL's implementation of RSA is vulnerable to the Klima-Pokorny-Rosa attack, allowing an attacker to perform one private key operation on chosen ciphertext using the server's private RSA key. A variant of the Bleichenbacher attack, this attack aims to compromise the premaster-secret value from which session keys are derived. This attack targets OpenSSL's implementation of RSA with PKCS #1 v1.5 padding used in SSL 3.0 and TLS 1.0. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-288.nasl - Type : ACT_GATHER_INFO |
| 2004-07-31 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2003-035.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2003-102.nasl - Type : ACT_GATHER_INFO |
| 2003-02-20 | Name : The remote host has an application that is affected by multiple vulnerabilities. File : openssl_password_interception.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:48:06 |
|
