CVE-2003-0147

Description

OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 22.86% Top 5%

Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory marc.info Vendor Advisory securityfocus.com Vendor Advisory sco.com Vendor Advisory mandrakesecure.net Vendor Advisory gentoo.org Vendor Advisory openpkg.com Vendor Advisory marc.info Vendor Advisory securityfocus.com Vendor Advisory sgi.com Vendor Advisory com.br Vendor Advisory neohapsis.com

Affected: n/a n/a

References

Link	Tags
http://www.debian.org/security/2003/dsa-288	vendor advisory
http://www.redhat.com/support/errata/RHSA-2003-101.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2003-102.html	vendor advisory
http://www.openssl.org/news/secadv_20030317.txt
http://marc.info/?l=bugtraq&m=104829040921835&w=2	vendor advisory
http://www.securityfocus.com/archive/1/316165/30/25370/threaded	mailing list vendor advisory
http://marc.info/?l=bugtraq&m=104792570615648&w=2	mailing list
ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt	vendor advisory
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:035	vendor advisory
http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
http://www.gentoo.org/security/en/glsa/glsa-200303-23.xml	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A466	vdb entry signature
http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.019.html	vendor advisory
http://marc.info/?l=bugtraq&m=104861762028637&w=2	vendor advisory
http://www.securityfocus.com/archive/1/316577/30/25310/threaded	mailing list vendor advisory
ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I	vendor advisory
http://marc.info/?l=bugtraq&m=104766550528628&w=2	mailing list
http://marc.info/?l=bugtraq&m=104819602408063&w=2	mailing list
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625	vendor advisory
http://www.kb.cert.org/vuls/id/997481	third party advisory us government resource
http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0130.html	mailing list vendor advisory

Frequently Asked Questions

What is the severity of CVE-2003-0147?: CVE-2003-0147 has been scored as a medium severity vulnerability.
How to fix CVE-2003-0147?: To fix CVE-2003-0147, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2003-0147 being actively exploited in the wild?: It is possible that CVE-2003-0147 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~23% probability that this vulnerability will be exploited by malicious actors in the next 30 days.