Home > Vulnerability Database > CVE-2003-0147

Mend.io Vulnerability Database

CVE-2003-0147

Good to know:

Date: March 18, 2003

OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).

Language: C

Severity Score

5.3

Related Resources (24)

Url: http://www.securityfocus.com/archive/1/316577/30/25310/threaded

Url: http://www.securityfocus.com/archive/1/316165/30/25370/threaded

Url: http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf

Url: http://www.debian.org/security/2003/dsa-288

Url: ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I

Url: http://marc.info/?l=bugtraq&m=104829040921835&w=2

Url: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0130.html

Url: http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.019.html

Url: http://www.openssl.org/news/secadv_20030317.txt

Url: http://marc.info/?l=bugtraq&m=104792570615648&w=2

Url: http://www.gentoo.org/security/en/glsa/glsa-200303-23.xml

Url: http://www.kb.cert.org/vuls/id/997481

Url: https://nvd.nist.gov/vuln/detail/CVE-2003-0147

Url: http://www.redhat.com/support/errata/RHSA-2003-102.html

Url: http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:035

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A466

Url: http://marc.info/?l=bugtraq&m=104819602408063&w=2

Url: http://marc.info/?l=bugtraq&m=104861762028637&w=2

Url: ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt

Url: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625

Url: http://www.redhat.com/support/errata/RHSA-2003-101.html

Url: http://marc.info/?l=bugtraq&m=104766550528628&w=2

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2003-0147

Url: https://www.mend.io/vulnerability-database/CVE-2003-0147

Severity Score

5.3

Top Fix

Upgrade Version

Upgrade to version 0.9.7b, 0.9.6j

Learn More

CVSS v3.1

Base Score:	5.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2003-0147

Good to know:

Date: March 18, 2003

Language: C

Severity Score

Related Resources (24)

Severity Score

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?