OpenSSL Private Key Disclosure

medium Log Correlation Engine Plugin ID 801066

Synopsis

N/A

Description

The remote host is running a version of OpenSSL which is vulnerable to a timing attack which may allow an attacker to recover the content of fixed data blocks and even eventually the RSA private key of the web server.

Solution

Upgrade to OpenSSL 0.9.6i or 0.9.7a

See Also

http://.openssl.org/news/secadv_20030219.txt

lasecwww.epfl.ch/memo_ssl.shtml

eprint.iacr.org/2003/052

http://.openssl.org/news/secadv_20030219.txt, http://lasecwww.epfl.ch/memo_ssl.shtml, http://eprint.iacr.org/2003/052

Plugin Details

Severity: Medium

ID: 801066

Family: Web Servers

Nessus ID: 11267

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Reference Information

CVE: CVE-2003-0078, CVE-2003-0131, CVE-2003-0147

BID: 7148, 6884