CVE-2003-0147
Summary
| CVE | CVE-2003-0147 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2003-03-31 05:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal). |
Risk And Classification
Primary CVSS: v2.0 5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:N/A:N
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Openpkg | Openpkg | All | All | All | All |
| Application | Openpkg | Openpkg | 1.1 | All | All | All |
| Application | Openpkg | Openpkg | 1.2 | All | All | All |
| Application | Openssl | Openssl | 0.9.6 | All | All | All |
| Application | Openssl | Openssl | 0.9.6a | All | All | All |
| Application | Openssl | Openssl | 0.9.6b | All | All | All |
| Application | Openssl | Openssl | 0.9.6c | All | All | All |
| Application | Openssl | Openssl | 0.9.6d | All | All | All |
| Application | Openssl | Openssl | 0.9.6e | All | All | All |
| Application | Openssl | Openssl | 0.9.6g | All | All | All |
| Application | Openssl | Openssl | 0.9.6h | All | All | All |
| Application | Openssl | Openssl | 0.9.6i | All | All | All |
| Application | Openssl | Openssl | 0.9.7 | All | All | All |
| Application | Openssl | Openssl | 0.9.7a | All | All | All |
| Application | Stunnel | Stunnel | 3.10 | All | All | All |
| Application | Stunnel | Stunnel | 3.11 | All | All | All |
| Application | Stunnel | Stunnel | 3.12 | All | All | All |
| Application | Stunnel | Stunnel | 3.13 | All | All | All |
| Application | Stunnel | Stunnel | 3.14 | All | All | All |
| Application | Stunnel | Stunnel | 3.15 | All | All | All |
| Application | Stunnel | Stunnel | 3.16 | All | All | All |
| Application | Stunnel | Stunnel | 3.17 | All | All | All |
| Application | Stunnel | Stunnel | 3.18 | All | All | All |
| Application | Stunnel | Stunnel | 3.19 | All | All | All |
| Application | Stunnel | Stunnel | 3.20 | All | All | All |
| Application | Stunnel | Stunnel | 3.21 | All | All | All |
| Application | Stunnel | Stunnel | 3.22 | All | All | All |
| Application | Stunnel | Stunnel | 3.7 | All | All | All |
| Application | Stunnel | Stunnel | 3.8 | All | All | All |
| Application | Stunnel | Stunnel | 3.9 | All | All | All |
| Application | Stunnel | Stunnel | 4.0 | All | All | All |
| Application | Stunnel | Stunnel | 4.01 | All | All | All |
| Application | Stunnel | Stunnel | 4.02 | All | All | All |
| Application | Stunnel | Stunnel | 4.03 | All | All | All |
| Application | Stunnel | Stunnel | 4.04 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| crypto.stanford.edu/~dabo/papers/ssl-timing.pdf | af854a3a-2127-422b-91ae-364da2661108 | crypto.stanford.edu | |
| '[OpenPKG-SA-2003.026] OpenPKG Security Advisory (openssl)' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt | af854a3a-2127-422b-91ae-364da2661108 | ftp.sco.com | |
| 'GLSA: stunnel (200303-24)' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| patches.sgi.com/support/free/security/advisories/20030501-01-I | af854a3a-2127-422b-91ae-364da2661108 | patches.sgi.com | |
| 'GLSA: openssl (200303-15)' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| 'Vulnerability in OpenSSL' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Neohapsis Archives - VulnWatch - #0130 - [VulnWatch] OpenSSL Private Key Disclosure | af854a3a-2127-422b-91ae-364da2661108 | archives.neohapsis.com | Vendor Advisory |
| CERT/CC Vulnerability Note VU#997481 | af854a3a-2127-422b-91ae-364da2661108 | www.kb.cert.org | Third Party Advisory, US Government Resource |
| www.openssl.org/news/secadv_20030317.txt | af854a3a-2127-422b-91ae-364da2661108 | www.openssl.org | |
| '[ADVISORY] Timing Attack on OpenSSL' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Home - Conectiva | af854a3a-2127-422b-91ae-364da2661108 | distro.conectiva.com.br | |
| MandrakeSecure: MandrakeSoft Security Advisory MDKSA-2003:035 : openssl | af854a3a-2127-422b-91ae-364da2661108 | www.mandrakesecure.net | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| OpenPKG Corporation: Security: Security Advisories | af854a3a-2127-422b-91ae-364da2661108 | www.openpkg.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Gentoo Linux — Error 404 (Not Found) | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | |
| Debian -- Security Information -- DSA-288-1 openssl | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2007-03-14 | Mark J Cox | Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. |
There are currently no legacy QID mappings associated with this CVE.