OpenSSL Private Key Disclosure

Medium Nessus Network Monitor Plugin ID 1515

Synopsis

The remote host is running a vulnerable version of OpenSSL.

Description

The remote host is running a version of OpenSSL which is vulnerable to a timing attack which may allow an attacker to recover the content of fixed data blocks and even eventually the RSA private key of the web server.

Solution

Upgrade to OpenSSL 0.9.6i or 0.9.7a

See Also

http://www.openssl.org/news/secadv_20030219.txt

http://lasecwww.epfl.ch/memo_ssl.shtml

http://eprint.iacr.org/2003/052

http://www.openssl.org/news/secadv_20030219.txt, http://lasecwww.epfl.ch/memo_ssl.shtml, http://eprint.iacr.org/2003/052

Plugin Details

Severity: Medium

ID: 1515

Family: Web Servers

Published: 2004/08/18

Modified: 2018/09/16

Dependencies: 5563

Nessus ID: 11267

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSSv3

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:openssl:openssl

Reference Information

CVE: CVE-2003-0147, CVE-2003-0078, CVE-2003-0131

BID: 7148, 6884