CVE-2014-0076

Description

The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.

Category

1.9
CVSS
Severity: Low
CVSS 2.0 •
EPSS 0.34%
Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory marc.info Vendor Advisory cisco.com Vendor Advisory marc.info Vendor Advisory ubuntu.com Vendor Advisory marc.info Vendor Advisory mandriva.com Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory mandriva.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://www.novell.com/support/kb/doc.php?id=7015300
http://secunia.com/advisories/59264 third party advisory
http://secunia.com/advisories/59454 third party advisory
http://www.securityfocus.com/bid/66363 vdb entry
http://secunia.com/advisories/58492 third party advisory
http://www.novell.com/support/kb/doc.php?id=7015264
https://bugs.gentoo.org/show_bug.cgi?id=505278
http://secunia.com/advisories/59445 third party advisory
http://marc.info/?l=bugtraq&m=140266410314613&w=2 vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676655
http://www-01.ibm.com/support/docview.wss?uid=swg21676092
http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=2198be3483259de374f91e57d247d0fc667aef29
http://www-01.ibm.com/support/docview.wss?uid=isg400001843
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946
http://marc.info/?l=bugtraq&m=140317760000786&w=2 vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21677828
http://marc.info/?l=bugtraq&m=140621259019789&w=2 vendor advisory
http://secunia.com/advisories/59300 third party advisory
http://advisories.mageia.org/MGASA-2014-0165.html
http://www-01.ibm.com/support/docview.wss?uid=swg21677695
http://lists.opensuse.org/opensuse-updates/2014-04/msg00007.html vendor advisory
http://secunia.com/advisories/59495 third party advisory
http://www-01.ibm.com/support/docview.wss?uid=isg400001841
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html vendor advisory
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://secunia.com/advisories/59655 third party advisory
http://secunia.com/advisories/59374 third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676501
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://marc.info/?l=bugtraq&m=140389274407904&w=2 vendor advisory
http://secunia.com/advisories/58939 third party advisory
http://secunia.com/advisories/59514 third party advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl vendor advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10075
http://www-01.ibm.com/support/docview.wss?uid=swg21676419
http://secunia.com/advisories/59438 third party advisory
http://marc.info/?l=bugtraq&m=140482916501310&w=2 vendor advisory
http://secunia.com/advisories/58727 third party advisory
http://www.openssl.org/news/secadv_20140605.txt
http://support.apple.com/kb/HT6443
http://www.ubuntu.com/usn/USN-2165-1 vendor advisory
http://marc.info/?l=bugtraq&m=140904544427729&w=2 vendor advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
http://www.mandriva.com/security/advisories?name=MDVSA-2014:067 vendor advisory
http://marc.info/?l=bugtraq&m=140752315422991&w=2 vendor advisory
https://bugzilla.novell.com/show_bug.cgi?id=869945
http://secunia.com/advisories/59040 third party advisory
http://marc.info/?l=bugtraq&m=140389355508263&w=2 vendor advisory
http://secunia.com/advisories/59175 third party advisory
http://marc.info/?l=bugtraq&m=140448122410568&w=2 vendor advisory
http://secunia.com/advisories/59413 third party advisory
http://secunia.com/advisories/59721 third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676062
http://www-01.ibm.com/support/docview.wss?uid=swg21673137
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062 vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676035
http://secunia.com/advisories/59450 third party advisory
http://secunia.com/advisories/59364 third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676424
http://secunia.com/advisories/60571 third party advisory
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm
http://secunia.com/advisories/59162 third party advisory
http://secunia.com/advisories/59490 third party advisory
http://eprint.iacr.org/2014/140

Frequently Asked Questions

What is the severity of CVE-2014-0076?
CVE-2014-0076 has been scored as a low severity vulnerability.
How to fix CVE-2014-0076?
To fix CVE-2014-0076, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2014-0076 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2014-0076 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.