OpenSSL Private Key Disclosure

low Nessus Network Monitor Plugin ID 1515

Synopsis

The remote host is running a vulnerable version of OpenSSL.

Description

The remote host is running a version of OpenSSL which is vulnerable to a timing attack which may allow an attacker to recover the content of fixed data blocks and even eventually the RSA private key of the web server.

Solution

Upgrade to OpenSSL 0.9.6i or 0.9.7a

Plugin Details

Severity: Low

ID: 1515

Family: Web Servers

Published: 8/18/2004

Updated: 3/6/2019

Nessus ID: 11267

Risk Information

VPR

Risk Factor: Medium

Score: 5.1

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:openssl:openssl

Reference Information

CVE: CVE-2003-0078, CVE-2003-0131, CVE-2003-0147

BID: 7148, 6884

Detections

Analytics