CVE-2003-0131

Published: Mar 24, 2003Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."

Affected (11)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 0.9.6
Openssl Openssl	Version 0.9.6a
Openssl Openssl	Version 0.9.6b
Openssl Openssl	Version 0.9.6c
Openssl Openssl	Version 0.9.6d
Openssl Openssl	Version 0.9.6e
Openssl Openssl	Version 0.9.6g
Openssl Openssl	Version 0.9.6h
Openssl Openssl	Version 0.9.6i
Openssl Openssl	Version 0.9.7
Openssl Openssl	Version 0.9.7a

References (48)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-007.txt.asc (unsafe URL)

Source: cve@mitre.org

ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt (unsafe URL)

Source: cve@mitre.org

ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I (unsafe URL)

Source: cve@mitre.org

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625

Source: cve@mitre.org

http://eprint.iacr.org/2003/052/

Source: cve@mitre.org

Vendor Advisory

http://lists.apple.com/mhonarc/security-announce/msg00028.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=104811162730834&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=104852637112330&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=104878215721135&w=2

Source: cve@mitre.org

http://www.debian.org/security/2003/dsa-288

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200303-20.xml

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/888801

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.linuxsecurity.com/advisories/immunix_advisory-3066.html

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2003:035

Source: cve@mitre.org

http://www.openpkg.org/security/OpenPKG-SA-2003.026-openssl.html

Source: cve@mitre.org

http://www.openssl.org/news/secadv_20030319.txt

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2003-101.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2003-102.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/316577/30/25310/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/316577/30/25310/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/7148

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/11586

Source: cve@mitre.org

https://lists.opensuse.org/opensuse-security-announce/2003-04/msg00005.html

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A461

Source: cve@mitre.org

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-007.txt.asc (unsafe URL)