OpenPKG Security Advisory
OpenPKG-SA-2003.026
Publisher Name: OpenPKG GmbH Publisher Home: http://openpkg.com/ Advisory Id (public): OpenPKG-SA-2003.026 Advisory Type: OpenPKG Security Advisory (SA) Advisory Directory: http://openpkg.com/go/OpenPKG-SA Advisory Document: http://openpkg.com/go/OpenPKG-SA-2003.026 Advisory Published: 2008-11-21 22:54 UTC Issue Id (internal): OpenPKG-SI-20030320.02 Issue First Created: 2003-03-20 Issue Last Modified: 2006-11-28 Issue Revision: 05
Subject Name: OpenSSL Subject Summary: Cryptography and SSL/TLS Toolkit Subject Home: http://www.openssl.org/ Subject Versions: * <= 0.9.7a Vulnerability Id: CVE-2003-0131 Vulnerability Scope: global (not OpenPKG specific) Attack Feasibility: run-time Attack Vector: remote network Attack Impact: exposure of sensitive information Description: According to an OpenSSL [0] security advisory [1], Czech cryptologists Vlastimil Klima, Ondrej Pokorny, and Tomas Rosa have come up with an extension of the "Bleichenbacher attack" on RSA with PKCS #1 v1.5 padding as used in SSL 3.0 and TLS 1.0. The attack was documented in their report "Attacking RSA-based Sessions in SSL/TLS" [2]. Their attack requires the attacker to open millions of SSL/TLS connections to the server under attack. The server's behaviour when faced with specially made-up RSA ciphertexts can reveal information that in effect allows the attacker to perform a single RSA private key operation on a ciphertext of its choice using the server's RSA key. Note that the server's RSA key is not compromised in this attack. References: [0] http://www.openssl.org/ [1] http://www.openssl.org/news/secadv_20030319.txt [2] http://eprint.iacr.org/2003/052/ [3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0131 [4] http://www.openpkg.org/tutorial.html#regular-source [5] http://www.openpkg.org/tutorial.html#regular-binary [6] ftp://ftp.openpkg.org/release/1.1/UPD/openssl-0.9.6g-1.1.3.src.rpm [7] ftp://ftp.openpkg.org/release/1.2/UPD/openssl-0.9.7-1.2.3.src.rpm [8] ftp://ftp.openpkg.org/release/1.1/UPD/ [9] ftp://ftp.openpkg.org/release/1.2/UPD/ [10] http://www.openpkg.org/security.html#signature
Primary Package Name: openssl Primary Package Home: http://openpkg.org/go/package/openssl Affected Distribution: Affected Branch: Affected Package: OpenPKG Community 1.1-SOLID openssl-0.9.6g-1.1.2 OpenPKG Community 1.2-SOLID openssl-0.9.7-1.2.2 OpenPKG Community CURRENT openssl-0.9.7a-20030317 Corrected Distribution: Corrected Branch: Corrected Package: OpenPKG Community 1.1-SOLID openssl-0.9.6g-1.1.3 OpenPKG Community 1.2-SOLID openssl-0.9.7-1.2.3 OpenPKG Community CURRENT openssl-0.9.7a-20030320
