OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).

The version of OpenSSL installed on the remote host is prior to 0.9.6j. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.6j advisory.

  - The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to     perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large     number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information     regarding the relationship between ciphertext and the associated plaintext, aka the Klima-Pokorny-Rosa     attack. (CVE-2003-0131)

  - OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the     server's private key by determining factors using timing differences on (1) the number of extra reductions     during Montgomery reduction, and (2) the use of different integer multiplication algorithms (Karatsuba     and normal). (CVE-2003-0147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 0.9.7b. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.7b advisory.

  - The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to     perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large     number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information     regarding the relationship between ciphertext and the associated plaintext, aka the Klima-Pokorny-Rosa     attack. (CVE-2003-0131)

  - OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the     server's private key by determining factors using timing differences on (1) the number of extra reductions     during Montgomery reduction, and (2) the use of different integer multiplication algorithms (Karatsuba     and normal). (CVE-2003-0147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Researchers discovered two flaws in OpenSSL, a Secure Socket Layer (SSL) library and related cryptographic tools. Applications that are linked against this library are generally vulnerable to attacks that could leak the server's private key or make the encrypted session decryptable otherwise. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities :

 CAN-2003-0147 OpenSSL does not use RSA blinding by default, which  allows local and remote attackers to obtain the server's private key.
 CAN-2003-0131 The SSL allows remote attackers to perform an  unauthorized RSA private key operation that causes OpenSSL to leak  information regarding the relationship between ciphertext and the  associated plaintext.

The remote host is running a version of OpenSSL which is vulnerable to a timing attack which may allow an attacker to recover the content of fixed data blocks and even eventually the RSA private key of the web server.

Researchers discovered a timing-based attack on RSA keys that OpenSSL is generally vulnerable to, unless RSA blinding is enabled. Patches from the OpenSSL team have been applied to turn RSA blinding on by default.

An extension of the 'Bleichenbacher attack' on RSA with PKS #1 v1.5 padding as used in SSL 3.0 and TSL 1.0 was also created by Czech cryptologists Vlastimil Klima, Ondrej Pokorny, and Tomas Rosa. This attack requires the attacker to open millions of SSL/TLS connections to the server they are attacking. This is done because the server's behaviour when faced with specially crafted RSA ciphertexts can reveal information that would in effect allow the attacker to perform a single RSA private key operation on a ciphertext of their choice, using the server's RSA key. Despite this, the server's RSA key is not compromised at any time. Patches from the OpenSSL team modify SSL/TLS server behaviour to avoid this vulnerability.

Updated OpenSSL packages are available that fix a potential timing-based attack and a modified Bleichenbacher attack.

[Updated 30 May 2003] Added missing i686 packages.

OpenSSL is a commercial-grade, full-featured, open source toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, and provides a full-strength general purpose cryptography library.

Researchers discovered a timing attack on RSA keys. Applications making use of OpenSSL are generally vulnerable to such an attack, unless RSA blinding has been turned on. OpenSSL does not use RSA blinding by default and most applications do not enable RSA blinding.

A local or remote attacker could use this attack to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (Karatsuba and normal).

In order for an attack to be sucessful, an attacker must have good network conditions that allow small changes in timing to be reliably observed.

Additionally, the SSL and TLS components for OpenSSL allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack. This attack (also known as the Klima-Pokorny-Rosa attack) uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding to cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext.

These erratum packages contain a patch provided by the OpenSSL group that enables RSA blinding by default, and protects against the Klima-Pokorny-Rosa attack.

Because server applications are affected by these vulnerabilities, we advise users to restart all services that use OpenSSL functionality or, alternatively, reboot their systems after installing these updates.

According to its banner, the remote host is using a version of OpenSSL older than 0.9.6j or 0.9.7b.

This version is vulnerable to a timing-based attack that could allow an attacker to guess the content of fixed data blocks and may eventually be able to guess the value of the private RSA key of the server.

An attacker may use this implementation flaw to sniff the data going to this host and decrypt some parts of it, as well as impersonate the server and perform man-in-the-middle attacks.

ID	Name	Product	Family	Severity
200201	OpenSSL 0.9.6 < 0.9.6j Multiple Vulnerabilities	Nessus	Web Servers	medium
200199	OpenSSL 0.9.7 < 0.9.7b Multiple Vulnerabilities	Nessus	Web Servers	medium
15125	Debian DSA-288-1 : openssl - several vulnerabilities	Nessus	Debian Local Security Checks	high
1515	OpenSSL Private Key Disclosure	Nessus Network Monitor	Web Servers	low
14019	Mandrake Linux Security Advisory : openssl (MDKSA-2003:035)	Nessus	Mandriva Local Security Checks	high
12380	RHEL 2.1 : openssl (RHSA-2003:102)	Nessus	Red Hat Local Security Checks	high
11267	OpenSSL < 0.9.6j / 0.9.7b Multiple Vulnerabilities	Nessus	Web Servers	medium
801066	OpenSSL Private Key Disclosure	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2003-0147

high

Tenable Plugins

medium

medium

high

low

high

high

medium

medium