OpenSSL Private Key Disclosure

Medium Log Correlation Engine Plugin ID 801066

Synopsis

N/A

Description

The remote host is running a version of OpenSSL which is vulnerable to a timing attack which may allow an attacker to recover the content of fixed data blocks and even eventually the RSA private key of the web server.

Solution

Upgrade to OpenSSL 0.9.6i or 0.9.7a

See Also

http://.openssl.org/news/secadv_20030219.txt

lasecwww.epfl.ch/memo_ssl.shtml

eprint.iacr.org/2003/052

http://.openssl.org/news/secadv_20030219.txt, http://lasecwww.epfl.ch/memo_ssl.shtml, http://eprint.iacr.org/2003/052

Plugin Details

Severity: Medium

ID: 801066

File Name: 801066.prm

Family: Web Servers

Nessus ID: 11267

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Reference Information

CVE: CVE-2003-0147, CVE-2003-0078, CVE-2003-0131

BID: 7148, 6884