ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."

The version of OpenSSL installed on the remote host is prior to 0.9.6i. It is, therefore, affected by a vulnerability as referenced in the 0.9.6i advisory.

  - ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC     computation if an incorrect block cipher padding is used, which causes an information leak (timing     discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between     padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the     Vaudenay timing attack. (CVE-2003-0078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 0.9.7a. It is, therefore, affected by a vulnerability as referenced in the 0.9.7a advisory.

  - ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC     computation if an incorrect block cipher padding is used, which causes an information leak (timing     discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between     padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the     Vaudenay timing attack. (CVE-2003-0078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

s700_800 11.04 Virtualvault 4.6 OWS update : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A remotely exploitable potential vulnerability has been     reported in CAN-2003-0078.

  - #1 A defect in the Java(TM) Virtual Machine may allow     illegal access to protected fields or methods of an     object. #2 The Java(TM) Secure Socket Extension (JSSE)     may incorrectly validate the digital certificate of a     web site. In addition, the Java Plug-in and Java Web     Start may incorrectly validate the digital certificates     of signed JAR files.

s700_800 11.04 Virtualvault 4.5 OWS update : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A remotely exploitable potential vulnerability has been     reported in CAN-2003-0078.

  - #1 A defect in the Java(TM) Virtual Machine may allow     illegal access to protected fields or methods of an     object. #2 The Java(TM) Secure Socket Extension (JSSE)     may incorrectly validate the digital certificate of a     web site. In addition, the Java Plug-in and Java Web     Start may incorrectly validate the digital certificates     of signed JAR files.

A vulnerability has been discovered in OpenSSL, a Secure Socket Layer (SSL) implementation. In an upcoming paper, Brice Canvel (EPFL), Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and Martin Vuagnoux (EPFL, Ilion) describe and demonstrate a timing-based attack on CBC cipher suites used in SSL and TLS. OpenSSL has been found to be vulnerable to this attack.

The remote host is running a version of OpenSSL which is vulnerable to a timing attack which may allow an attacker to recover the content of fixed data blocks and even eventually the RSA private key of the web server.

In an upcoming paper, Brice Canvel (EPFL), Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and Martin Vuagnoux (EPFL, Ilion) describe and demonstrate a timing-based attack on CBC ciphersuites in SSL and TLS.

New versions of openssl have been released in response to this vulnerability (0.9.6i and 0.9.7a). The openssl released with Linux-Mandrake 7.2 and Single Network Firewall 7.2 has been patched to correct this issue.

The remote host is missing the patch for the advisory SUSE-SA:2003:011 (openssl).


OpenSSL is an implementation of the Secure Sockets Layer and Transport Layer Security protocols and provides strong cryptography for many applications in a Linux system. It is a default package in all SUSE products.

A security weakness has been found, known as 'Vaudenay timing attack on CBC', named after one of the discoverers (Brice Canvel (EPFL), Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and Martin Vuagnoux (EPFL, Ilion)).
The weakness may allow an attacker to obtain a plaintext data block by observing timing differences in response to two different error cases (cipher padding errors vs. MAC verification errors).
In order to exploit this vulnerability, the attacker has to meet certain requirements: The network connection between client and server must be of high quality to be able to observe timing differences, the attacker must be able to perform a man-in-the-middle attack, the transactions must repeatedly contain the same (encrypted) plain text block (such as a pop password or alike), and decoding failures in the SSL layer must not be propagated to the application that is using the SSL connection.
These exploitation conditions considerably reduce the security risk imposed by the vulnerability. However, we recommend to completely remedy this weakness by installing the update packages for your system according to the following guidelines. There does not exist any temporary workaround for this problem other than applying the update packages.


Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.

Updated OpenSSL packages are available that fix a potential timing-based attack.

[Updated 12 March 2003] Added packages for Red Hat Enterprise Linux ES and Red Hat Enterprise Linux WS

OpenSSL is a commercial-grade, full-featured, open source toolkit which implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength, general purpose cryptography library.

In a paper, Brice Canvel, Alain Hiltgen, Serge Vaudenay, and Martin Vuagnoux describe and demonstrate a timing-based attack on CBC ciphersuites in SSL and TLS. An active attacker may be able to use timing observations to distinguish between two different error cases:
cipher padding errors and MAC verification errors. Over multiple connections this can leak sufficient information to be able to retrieve the plaintext of a common, fixed block.

In order for an attack to be sucessful an attacker must be able to act as a man-in-the-middle to intercept and modify multiple connections which all involve a common fixed plaintext block (such as a password), and have good network conditions that allow small changes in timing to be reliably observed.

These updated packages contain a patch provided by the OpenSSL group that corrects this vulnerability.

Because server applications are affected by these vulnerabilities, we advise users to restart all services that use OpenSSL functionality or alternatively reboot their systems after installing these updates.

According to its banner, the remote host is using a version of OpenSSL older than 0.9.6j or 0.9.7b.

This version is vulnerable to a timing-based attack that could allow an attacker to guess the content of fixed data blocks and may eventually be able to guess the value of the private RSA key of the server.

An attacker may use this implementation flaw to sniff the data going to this host and decrypt some parts of it, as well as impersonate the server and perform man-in-the-middle attacks.

ID	Name	Product	Family	Severity
200207	OpenSSL 0.9.6 < 0.9.6i Vulnerability	Nessus	Web Servers	medium
200202	OpenSSL 0.9.7 < 0.9.7a Vulnerability	Nessus	Web Servers	medium
17497	HP-UX PHSS_28686 : s700_800 11.04 Virtualvault 4.6 OWS update	Nessus	HP-UX Local Security Checks	medium
17003	HP-UX PHSS_28685 : s700_800 11.04 Virtualvault 4.5 OWS update	Nessus	HP-UX Local Security Checks	medium
15090	Debian DSA-253-1 : openssl - information leak	Nessus	Debian Local Security Checks	medium
1515	OpenSSL Private Key Disclosure	Nessus Network Monitor	Web Servers	low
14005	Mandrake Linux Security Advisory : openssl (MDKSA-2003:020)	Nessus	Mandriva Local Security Checks	medium
13783	SUSE-SA:2003:011: openssl	Nessus	SuSE Local Security Checks	medium
12368	RHEL 2.1 : openssl (RHSA-2003:063)	Nessus	Red Hat Local Security Checks	medium
11267	OpenSSL < 0.9.6j / 0.9.7b Multiple Vulnerabilities	Nessus	Web Servers	medium
801066	OpenSSL Private Key Disclosure	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2003-0078

medium

Tenable Plugins

medium

medium

medium

medium

medium

low

medium

medium

medium

medium

medium