CVE-2003-0078
CVSS5.0
发布时间 :2003-03-03 00:00:00
修订时间 :2016-10-17 22:29:16
NMCOES    

[原文]ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."


[CNNVD]OpenSSL CBC错误信息泄露漏洞(CNNVD-200303-024)

        OpenSSL 0.9.7a之前的版本和0.9.6i之前的0.9.6版本中s3_pkt.c的ssl3_get_record如果使用不正确分组密码进行填充,将不执行MAC计算,可以导致信息泄露(时序差异),该漏洞可能更容易导致凭借区分填充和MAC检验错误差别的加密攻击,并且可能导致原始明文被提取,也称为“Vaudenay timing attack”。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:openssl:openssl:0.9.7:beta3OpenSSL Project OpenSSL 0.9.7 beta3
cpe:/a:openssl:openssl:0.9.7:beta2OpenSSL Project OpenSSL 0.9.7 beta2
cpe:/a:openssl:openssl:0.9.7OpenSSL Project OpenSSL 0.9.7
cpe:/a:openssl:openssl:0.9.5OpenSSL Project OpenSSL 0.9.5
cpe:/a:openssl:openssl:0.9.6OpenSSL Project OpenSSL 0.9.6
cpe:/a:openssl:openssl:0.9.3OpenSSL Project OpenSSL 0.9.3
cpe:/a:openssl:openssl:0.9.7:beta1OpenSSL Project OpenSSL 0.9.7 beta1
cpe:/a:openssl:openssl:0.9.4OpenSSL Project OpenSSL 0.9.4
cpe:/a:openssl:openssl:0.9.6aOpenSSL Project OpenSSL 0.9.6a
cpe:/a:openssl:openssl:0.9.6bOpenSSL Project OpenSSL 0.9.6b
cpe:/o:freebsd:freebsd:4.8:pre-release
cpe:/a:openssl:openssl:0.9.1cOpenSSL Project OpenSSL 0.9.1c
cpe:/o:freebsd:freebsd:4.2FreeBSD 4.2
cpe:/o:freebsd:freebsd:4.3FreeBSD 4.3
cpe:/o:freebsd:freebsd:4.6FreeBSD 4.6
cpe:/o:freebsd:freebsd:4.7FreeBSD 4.7
cpe:/o:openbsd:openbsd:3.2OpenBSD 3.2
cpe:/o:openbsd:openbsd:3.1OpenBSD 3.1
cpe:/a:openssl:openssl:0.9.6cOpenSSL Project OpenSSL 0.9.6c
cpe:/a:openssl:openssl:0.9.6dOpenSSL Project OpenSSL 0.9.6d
cpe:/a:openssl:openssl:0.9.6eOpenSSL Project OpenSSL 0.9.6e
cpe:/a:openssl:openssl:0.9.2bOpenSSL Project OpenSSL 0.9.2b
cpe:/o:freebsd:freebsd:5.0FreeBSD 5.0
cpe:/o:freebsd:freebsd:4.4FreeBSD 4.4
cpe:/a:openssl:openssl:0.9.5aOpenSSL Project OpenSSL 0.9.5a
cpe:/o:freebsd:freebsd:4.5FreeBSD 4.5
cpe:/a:openssl:openssl:0.9.6gOpenSSL Project OpenSSL 0.9.6g
cpe:/a:openssl:openssl:0.9.6hOpenSSL Project OpenSSL 0.9.6h

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0078
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-0078
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200303-024
(官方数据源) CNNVD

- 其它链接及资源

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-001.txt.asc
(UNKNOWN)  NETBSD  NetBSD-SA2003-001
ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I
(UNKNOWN)  SGI  20030501-01-I
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000570
(UNKNOWN)  CONECTIVA  CLSA-2003:570
http://marc.info/?l=bugtraq&m=104567627211904&w=2
(UNKNOWN)  BUGTRAQ  20030219 OpenSSL 0.9.7a and 0.9.6i released
http://marc.info/?l=bugtraq&m=104568426824439&w=2
(UNKNOWN)  BUGTRAQ  20030219 [OpenPKG-SA-2003.013] OpenPKG Security Advisory (openssl)
http://marc.info/?l=bugtraq&m=104577183206905&w=2
(UNKNOWN)  GENTOO  GLSA-200302-10
http://www.ciac.org/ciac/bulletins/n-051.shtml
(UNKNOWN)  CIAC  N-051
http://www.debian.org/security/2003/dsa-253
(VENDOR_ADVISORY)  DEBIAN  DSA-253
http://www.iss.net/security_center/static/11369.php
(VENDOR_ADVISORY)  XF  ssl-cbc-information-leak(11369)
http://www.linuxsecurity.com/advisories/engarde_advisory-2874.html
(UNKNOWN)  ENGARDE  ESA-20030220-005
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:020
(UNKNOWN)  MANDRAKE  MDKSA-2003:020
http://www.openssl.org/news/secadv_20030219.txt
(VENDOR_ADVISORY)  CONFIRM  http://www.openssl.org/news/secadv_20030219.txt
http://www.redhat.com/support/errata/RHSA-2003-062.html
(UNKNOWN)  REDHAT  RHSA-2003:062
http://www.redhat.com/support/errata/RHSA-2003-063.html
(UNKNOWN)  REDHAT  RHSA-2003:063
http://www.redhat.com/support/errata/RHSA-2003-082.html
(UNKNOWN)  REDHAT  RHSA-2003:082
http://www.redhat.com/support/errata/RHSA-2003-104.html
(UNKNOWN)  REDHAT  RHSA-2003:104
http://www.redhat.com/support/errata/RHSA-2003-205.html
(UNKNOWN)  REDHAT  RHSA-2003:205
http://www.securityfocus.com/bid/6884
(UNKNOWN)  BID  6884
http://www.trustix.org/errata/2003/0005
(UNKNOWN)  TRUSTIX  2003-0005

- 漏洞信息

OpenSSL CBC错误信息泄露漏洞
中危 设计错误
2003-03-03 00:00:00 2005-10-12 00:00:00
远程  
        OpenSSL 0.9.7a之前的版本和0.9.6i之前的0.9.6版本中s3_pkt.c的ssl3_get_record如果使用不正确分组密码进行填充,将不执行MAC计算,可以导致信息泄露(时序差异),该漏洞可能更容易导致凭借区分填充和MAC检验错误差别的加密攻击,并且可能导致原始明文被提取,也称为“Vaudenay timing attack”。

- 公告与补丁

        It is reported that certain versions of Computer Associates eTrust Security Command Center are prone to this vulnerability. Customers are advised to contact the vendor for further information pertaining to obtaining and applying appropriate updates.
        Hewlett-Packard has released an advisory (HPSBUX0309-280), which contains fix information to address this issue in J2SE and JSSE. Customers are advised to upgrade as soon as possible. Further information regarding obtaining and applying fixes can be found in the referenced advisory.
        NetBSD has released an advisory (2003-001) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
        Administrators and users are advised to upgrade to version 0.9.6i or 0.9.7a. OpenPKG has released upgrade RPMs.
        Conectiva has released an advisory (CLA-2003:570) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
        Debian has released an advisory (DSA 253-1) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
        Gentoo Linux have recommended that users who are running 'dev-libs/openssl' upgrade to 'openssl-0.9.6i' or 'openssl-0.9.7a' as follows:
        emerge sync
        emerge -u openssl
        emerge clean
        Mandrake has released an advisory (MDKSA-2003:020) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
        Trustix has released an advisory (TSLSA-2003-0005) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
        EnGarde has released an advisory ([ESA-20030220-005) which addresses this issue. Fix details may be found in the attached advisory.
        FreeBSD has released an updated Security Advisory. Users are advised to apply the new patches or to upgrade systems via CVS. Further information is available in the referenced advisory.
        OpenBSD has released security patches which address this issue. Further information is available from the OpenBSD eratta pages.
        SuSE has released an advisory (SuSE-SA:2003:011) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
        Apple has released an advisory which contains a fix for this issue. Further information is available from the Apple Security Update page.
        Red Hat Linux has released an advisory (RHSA-2003:062-11) containing fixes. Information about obtaining and applying fixes are available in the referenced advisory.
        Sun has released updated versions of the affected products to address this issue.
        Sun has also released an alert stating that this issue has been addressed in the latest release of JSSE, SDK, and JRE.
        HP has released advisory HPSBUX0303-248 (rev. 1) to address this issue.
        HP has released advisory HPSBUX0303-248 (rev. 2) to address this issue.
        Oracle has released an advisory and patches to address this issue. User are advised to obtain patches from the Oracle metalink site listed in references.
        Fixes available:
        OpenBSD OpenBSD 3.2
        
        Sun Cobalt RaQ 4
        
        Sun Cobalt RaQ 550
        
        Sun Cobalt RaQ XTR
        
        Sun Cobalt Qube 3
        
        OpenBSD OpenBSD 3.1
        
        OpenSSL Project OpenSSL 0.9.3
        
        OpenSSL Project OpenSSL 0.9.4
        
        OpenSSL Project OpenSSL 0.9.5 a
        
        OpenSSL Project OpenSSL 0.9.5
        
        OpenSSL Project OpenSSL 0.9.6 d
        
        OpenSSL Project OpenSSL 0.9.6 c
        

- 漏洞信息 (22264)

OpenSSL 0.9.x CBC Error Information Leakage Weakness (EDBID:22264)
linux remote
2003-02-19 Verified
0 Martin Vuagnoux
N/A [点击下载]
source: http://www.securityfocus.com/bid/6884/info

A side-channel attack against implementations of SSL exists that, through analysis of the timing of certain operations, can reveal sensitive information to an active adversary. This information leaked by vulnerable implementations is reportedly sufficient for an adaptive attack that will ultimately obtain plaintext of a target block of ciphertext.

The information loss was reduced in OpenSSL versions 0.9.6i and 0.9.7a. It is not known if other implementations are vulnerable to this or similar weaknesses.

*It should be noted that this attack is reportedly difficult to exploit and requires that the adversary be a man-in-the-middle. 

http://www.exploit-db.com/sploits/22264.tar.gz		

- 漏洞信息

3945
OpenSSL s3_pkt.c ssl3_get_record Function Distinguishing Attack Information Disclosure Weakness
Local Access Required, Remote / Network Access Cryptographic
Loss of Confidentiality
Exploit Public Vendor Verified

- 漏洞描述

OpenSSL versions 0.9.6h and prior and 0.9.7 contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a repeated block of plaintext in multiple OpenSSL/TLS sessions occur. A crafted block of ciphertext can be repeatedly injected into each session, which will kill that session but may ultimately lead to the disclosure of the repeated plaintext block, resulting in a loss of confidentiality.

- 时间线

2003-02-20 2002-05-02
2003-02-20 Unknow

- 解决方案

Upgrade to version 0.9.6i or 0.9.7a or higher, as they has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s): apply the vendor-supplied patch for versions 0.9.6e and later. Versions older than 0.9.6e must upgrade.

- 相关参考

- 漏洞作者

- 漏洞信息

OpenSSL CBC Error Information Leakage Weakness
Design Error 6884
Yes No
2003-02-19 12:00:00 2009-07-11 08:06:00
Discovery credited to Brice Canvel, Alain Hiltgen, Serge Vaudenay, and Martin Vuagnoux.

- 受影响的程序版本

Sun SDK (Windows Production Release) 1.4.1 _02
Sun SDK (Windows Production Release) 1.4.1 _01
Sun SDK (Windows Production Release) 1.4.1
Sun SDK (Solaris Production Release) 1.4.1 _02
Sun SDK (Solaris Production Release) 1.4.1 _01
Sun SDK (Solaris Production Release) 1.4.1
Sun SDK (Linux Production Release) 1.4.1 _02
Sun SDK (Linux Production Release) 1.4.1 _01
Sun SDK (Linux Production Release) 1.4.1
Sun ONE Web Server 6.0 SP5
Sun ONE Web Server 6.0 SP4
Sun ONE Web Server 6.0 SP3
Sun ONE Web Server 6.0 SP2
Sun ONE Web Server 6.0 SP1
Sun ONE Web Server 6.0
Sun ONE Application Server 7.0 Standard Edition
Sun ONE Application Server 7.0 Platform Edition
Sun JSSE 1.0.3 _01
Sun JSSE 1.0.3
Sun JRE (Windows Production Release) 1.4.1 _02
Sun JRE (Windows Production Release) 1.4.1 _01
+ Opera Software Opera Web Browser 7.11 j
+ Opera Software Opera Web Browser 7.11
Sun JRE (Windows Production Release) 1.4.1
Sun JRE (Solaris Production Release) 1.4.1 _02
Sun JRE (Solaris Production Release) 1.4.1 _01
+ Opera Software Opera Web Browser 7.11
Sun JRE (Solaris Production Release) 1.4.1
Sun Cobalt RaQ XTR
Sun Cobalt RaQ 550
Sun Cobalt RaQ 4
Sun Cobalt Qube 3
Oracle Oracle9i Standard Edition 9.2
Oracle Oracle9i Standard Edition 9.0.1
Oracle Oracle9i Standard Edition 8.1.7
Oracle Oracle9i Personal Edition 9.2
Oracle Oracle9i Personal Edition 9.0.1
Oracle Oracle9i Personal Edition 8.1.7
Oracle Oracle9i Enterprise Edition 9.2 .0
Oracle Oracle9i Enterprise Edition 9.0.1
Oracle Oracle9i Enterprise Edition 8.1.7
Oracle Oracle9i Application Server 9.0.3
Oracle Oracle9i Application Server 9.0.2
Oracle Oracle9i Application Server 1.0.2 .2
Oracle Oracle9i Application Server 1.0.2 .1s
Oracle Oracle HTTP Server 9.2 .0
+ Apache Software Foundation Apache 1.3.22
Oracle Oracle HTTP Server 9.0.1
Oracle Oracle HTTP Server 8.1.7
+ Apache Software Foundation Apache 1.3.12
+ Oracle Oracle8 8.1.7
+ Oracle Oracle8i Enterprise Edition 8.1.7 .0.0
+ Oracle Oracle8i Standard Edition 8.1.7
OpenSSL Project OpenSSL 0.9.7 beta3
OpenSSL Project OpenSSL 0.9.7 beta2
OpenSSL Project OpenSSL 0.9.7 beta1
OpenSSL Project OpenSSL 0.9.7
+ Caldera OpenUnix 8.0
+ Caldera UnixWare 7.1.3
+ Caldera UnixWare 7.1.1
+ FreeBSD FreeBSD 5.0
+ OpenBSD OpenBSD 3.2
+ OpenPKG OpenPKG 1.2
OpenSSL Project OpenSSL 0.9.6 h
OpenSSL Project OpenSSL 0.9.6 g
+ Conectiva Linux Enterprise Edition 1.0
+ FreeBSD FreeBSD 4.7 -RELEASE
+ FreeBSD FreeBSD 4.7
+ HP Apache-Based Web Server 2.0.43 .04
+ HP Apache-Based Web Server 2.0.43 .00
+ HP Webmin-Based Admin 1.0 .01
+ Immunix Immunix OS 7+
+ NetBSD NetBSD 1.6
+ OpenPKG OpenPKG 1.1
OpenSSL Project OpenSSL 0.9.6 e
+ FreeBSD FreeBSD 4.6 -RELEASE
+ FreeBSD FreeBSD 4.6
OpenSSL Project OpenSSL 0.9.6 d
+ Slackware Linux 8.1
OpenSSL Project OpenSSL 0.9.6 c
+ Conectiva Linux 8.0
+ Debian Linux 3.0 sparc
+ Debian Linux 3.0 s/390
+ Debian Linux 3.0 ppc
+ Debian Linux 3.0 mipsel
+ Debian Linux 3.0 mips
+ Debian Linux 3.0 m68k
+ Debian Linux 3.0 ia-64
+ Debian Linux 3.0 ia-32
+ Debian Linux 3.0 hppa
+ Debian Linux 3.0 arm
+ Debian Linux 3.0 alpha
+ Debian Linux 3.0
+ Mandriva Linux Mandrake 8.2
+ S.u.S.E. Linux 8.0 i386
+ S.u.S.E. Linux 8.0
OpenSSL Project OpenSSL 0.9.6 b
+ Mandriva Linux Mandrake 8.1 ia64
+ Mandriva Linux Mandrake 8.1
+ OpenBSD OpenBSD 3.1
+ OpenBSD OpenBSD 3.0
+ Red Hat Enterprise Linux AS 2.1 IA64
+ Red Hat Enterprise Linux AS 2.1
+ RedHat Enterprise Linux ES 2.1 IA64
+ RedHat Enterprise Linux ES 2.1
+ RedHat Enterprise Linux WS 2.1 IA64
+ RedHat Enterprise Linux WS 2.1
+ RedHat Linux 7.3 i386
+ RedHat Linux 7.3
+ RedHat Linux 7.2 ia64
+ RedHat Linux 7.2 i686
+ RedHat Linux 7.2 i386
+ RedHat Linux 7.2
+ RedHat Linux Advanced Work Station 2.1
+ S.u.S.E. Linux 7.3 sparc
+ S.u.S.E. Linux 7.3 ppc
+ S.u.S.E. Linux 7.3 i386
+ S.u.S.E. Linux Connectivity Server
+ S.u.S.E. Linux Database Server 0
+ S.u.S.E. Linux Firewall on CD
+ S.u.S.E. Office Server
+ S.u.S.E. SuSE eMail Server III
+ Sun Linux 5.0.7
+ Sun Linux 5.0.6
+ Sun Linux 5.0.5
+ Sun Linux 5.0.3
+ Sun Linux 5.0
+ SuSE SUSE Linux Enterprise Server 7
OpenSSL Project OpenSSL 0.9.6 a
+ Conectiva Linux 7.0
+ NetBSD NetBSD 1.5.3
+ NetBSD NetBSD 1.5.2
+ NetBSD NetBSD 1.5.1
+ NetBSD NetBSD 1.5
+ S.u.S.E. Linux 7.2 i386
+ S.u.S.E. Linux 7.1 sparc
+ S.u.S.E. Linux 7.1 ppc
+ S.u.S.E. Linux 7.1 alpha
+ S.u.S.E. Linux 7.1
OpenSSL Project OpenSSL 0.9.6
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1.1
+ Caldera OpenLinux Workstation 3.1
+ Conectiva Linux 6.0
+ EnGarde Secure Linux 1.0.1
+ HP Secure OS software for Linux 1.0
+ Mandriva Linux Mandrake 8.0 ppc
+ Mandriva Linux Mandrake 8.0
+ NetBSD NetBSD 1.6 beta
+ NetBSD NetBSD 1.6
+ NetBSD NetBSD 1.5.3
+ NetBSD NetBSD 1.5.2
+ NetBSD NetBSD 1.5.1
+ NetBSD NetBSD 1.5
+ OpenBSD OpenBSD 2.9
+ OpenPKG OpenPKG 1.0
+ RedHat Linux 7.3 i386
+ RedHat Linux 7.3
+ RedHat Linux 7.2 i386
+ RedHat Linux 7.2 alpha
+ RedHat Linux 7.1 i386
+ RedHat Linux 7.1 alpha
+ RedHat Linux 7.0 sparc
+ RedHat Linux 7.0 i386
+ RedHat Linux 7.0 alpha
+ Trustix Secure Linux 1.5
+ Trustix Secure Linux 1.2
+ Trustix Secure Linux 1.1
OpenSSL Project OpenSSL 0.9.5 a
+ Debian Linux 3.0
+ HP Secure OS software for Linux 1.0
+ Immunix Immunix OS 7.0
+ Immunix Immunix OS 6.2
+ MandrakeSoft Corporate Server 1.0.1
+ MandrakeSoft Single Network Firewall 7.2
+ Mandriva Linux Mandrake 7.2
+ Mandriva Linux Mandrake 7.1
+ OpenBSD OpenBSD 2.8
+ OpenBSD OpenBSD 2.7
+ Red Hat Linux 6.2
+ RedHat Linux 7.3 i386
+ RedHat Linux 7.2 ia64
+ RedHat Linux 7.2 i686
+ RedHat Linux 7.2 i386
+ RedHat Linux 7.2 alpha
+ RedHat Linux 7.2
+ RedHat Linux 7.1 ia64
+ RedHat Linux 7.1 i386
+ RedHat Linux 7.1 alpha
+ RedHat Linux 7.1
+ RedHat Linux 7.0 i386
+ RedHat Linux 7.0 alpha
+ RedHat Linux 7.0
+ RedHat Linux 6.2 sparc
+ RedHat Linux 6.2 i386
+ RedHat Linux 6.2 alpha
+ S.u.S.E. Linux 7.0 sparc
+ S.u.S.E. Linux 7.0 ppc
+ S.u.S.E. Linux 7.0 i386
+ S.u.S.E. Linux 7.0 alpha
OpenSSL Project OpenSSL 0.9.5
+ RedHat Linux 6.2 sparc
+ RedHat Linux 6.2 i386
+ RedHat Linux 6.2 alpha
OpenSSL Project OpenSSL 0.9.4
+ Debian Linux 3.0
+ OpenBSD OpenBSD 2.6
OpenSSL Project OpenSSL 0.9.3
OpenSSL Project OpenSSL 0.9.2 b
OpenSSL Project OpenSSL 0.9.1 c
OpenBSD OpenBSD 3.2
OpenBSD OpenBSD 3.1
HP Webmin-Based Admin 1.0 .01
- HP HP-UX 11.22
- HP HP-UX 11.20
- HP HP-UX 11.11
- HP HP-UX 11.0
HP HP-UX Apache-Based Web Server 1.0 .01
- HP HP-UX 11.22
- HP HP-UX 11.20
- HP HP-UX 11.11
- HP HP-UX 11.0
HP Apache-Based Web Server 2.0.43 .00
- HP HP-UX 11.22
- HP HP-UX 11.20
- HP HP-UX 11.11
- HP HP-UX 11.0
HP Apache-Based Web Server 1.3.27 .00
- HP HP-UX 11.22
- HP HP-UX 11.20
- HP HP-UX 11.11
- HP HP-UX 11.0
FreeBSD FreeBSD 5.0
FreeBSD FreeBSD 4.8 -PRERELEASE
FreeBSD FreeBSD 4.7 -STABLE
FreeBSD FreeBSD 4.7
FreeBSD FreeBSD 4.6.2
FreeBSD FreeBSD 4.6
FreeBSD FreeBSD 4.5
FreeBSD FreeBSD 4.4
FreeBSD FreeBSD 4.3
FreeBSD FreeBSD 4.2
Computer Associates eTrust Security Command Center 1.0
Apple Mac OS X 10.2.4
Sun SDK (Windows Production Release) 1.4.1 _03
Sun SDK (Solaris Production Release) 1.4.1 _03
Sun SDK (Linux Production Release) 1.4.1 _03
Sun ONE Web Server 6.0 SP6
Sun ONE Application Server 7.0 UR1 Standard Edition
Sun ONE Application Server 7.0 UR1 Platform Edition
Sun JSSE 1.0.3 _02
Sun JRE (Windows Production Release) 1.4.1 _03
Sun JRE (Solaris Production Release) 1.4.1 _03
Sun JRE (Linux Production Release) 1.4.1 _03
OpenSSL Project OpenSSL 0.9.7 a
+ Conectiva Linux 9.0
+ OpenPKG OpenPKG Current
OpenSSL Project OpenSSL 0.9.6 i
+ HP Apache-Based Web Server 1.3.27 .01
+ HP Apache-Based Web Server 1.3.27 .00
+ HP HP-UX Apache-Based Web Server 1.0.1 .01
+ HP HP-UX Apache-Based Web Server 1.0 .07.01
+ HP HP-UX Apache-Based Web Server 1.0 .06.02
+ HP HP-UX Apache-Based Web Server 1.0 .06.01
+ HP HP-UX Apache-Based Web Server 1.0 .05.01
+ HP HP-UX Apache-Based Web Server 1.0 .04.01
+ HP HP-UX Apache-Based Web Server 1.0 .03.01
+ HP HP-UX Apache-Based Web Server 1.0 .02.01
+ HP HP-UX Apache-Based Web Server 1.0 .01
+ MandrakeSoft Corporate Server 2.1 x86_64
+ MandrakeSoft Corporate Server 2.1
+ Mandriva Linux Mandrake 9.1 ppc
+ Mandriva Linux Mandrake 9.1
+ Mandriva Linux Mandrake 9.0
+ S.u.S.E. Linux Personal 8.2
HP Webmin-Based Admin 1.0.1 .01
- HP HP-UX 11.22
- HP HP-UX 11.20
- HP HP-UX 11.11
- HP HP-UX 11.0
HP HP-UX Apache-Based Web Server 1.0.1 .01
- HP HP-UX 11.22
- HP HP-UX 11.20
- HP HP-UX 11.11
- HP HP-UX 11.0
HP HP-UX Apache-Based Web Server 1.0 .07.01
HP Apache-Based Web Server 1.3.27 .01
- HP HP-UX 11.22
- HP HP-UX 11.20
- HP HP-UX 11.11
- HP HP-UX 11.0

- 不受影响的程序版本

Sun SDK (Windows Production Release) 1.4.1 _03
Sun SDK (Solaris Production Release) 1.4.1 _03
Sun SDK (Linux Production Release) 1.4.1 _03
Sun ONE Web Server 6.0 SP6
Sun ONE Application Server 7.0 UR1 Standard Edition
Sun ONE Application Server 7.0 UR1 Platform Edition
Sun JSSE 1.0.3 _02
Sun JRE (Windows Production Release) 1.4.1 _03
Sun JRE (Solaris Production Release) 1.4.1 _03
Sun JRE (Linux Production Release) 1.4.1 _03
OpenSSL Project OpenSSL 0.9.7 a
+ Conectiva Linux 9.0
+ OpenPKG OpenPKG Current
OpenSSL Project OpenSSL 0.9.6 i
+ HP Apache-Based Web Server 1.3.27 .01
+ HP Apache-Based Web Server 1.3.27 .00
+ HP HP-UX Apache-Based Web Server 1.0.1 .01
+ HP HP-UX Apache-Based Web Server 1.0 .07.01
+ HP HP-UX Apache-Based Web Server 1.0 .06.02
+ HP HP-UX Apache-Based Web Server 1.0 .06.01
+ HP HP-UX Apache-Based Web Server 1.0 .05.01
+ HP HP-UX Apache-Based Web Server 1.0 .04.01
+ HP HP-UX Apache-Based Web Server 1.0 .03.01
+ HP HP-UX Apache-Based Web Server 1.0 .02.01
+ HP HP-UX Apache-Based Web Server 1.0 .01
+ MandrakeSoft Corporate Server 2.1 x86_64
+ MandrakeSoft Corporate Server 2.1
+ Mandriva Linux Mandrake 9.1 ppc
+ Mandriva Linux Mandrake 9.1
+ Mandriva Linux Mandrake 9.0
+ S.u.S.E. Linux Personal 8.2
HP Webmin-Based Admin 1.0.1 .01
- HP HP-UX 11.22
- HP HP-UX 11.20
- HP HP-UX 11.11
- HP HP-UX 11.0
HP HP-UX Apache-Based Web Server 1.0.1 .01
- HP HP-UX 11.22
- HP HP-UX 11.20
- HP HP-UX 11.11
- HP HP-UX 11.0
HP HP-UX Apache-Based Web Server 1.0 .07.01
HP Apache-Based Web Server 1.3.27 .01
- HP HP-UX 11.22
- HP HP-UX 11.20
- HP HP-UX 11.11
- HP HP-UX 11.0

- 漏洞讨论

A side-channel attack against implementations of SSL exists that, through analysis of the timing of certain operations, can reveal sensitive information to an active adversary. This information leaked by vulnerable implementations is reportedly sufficient for an adaptive attack that will ultimately obtain plaintext of a target block of ciphertext.

The information loss was reduced in OpenSSL versions 0.9.6i and 0.9.7a. It is not known if other implementations are vulnerable to this or similar weaknesses.

*It should be noted that this attack is reportedly difficult to exploit and requires that the adversary be a man-in-the-middle.

- 漏洞利用

The following exploit was provided by Martin Vuagnoux:

- 解决方案

It is reported that certain versions of Computer Associates eTrust Security Command Center are prone to this vulnerability. Customers are advised to contact the vendor for further information pertaining to obtaining and applying appropriate updates.

Hewlett-Packard has released an advisory (HPSBUX0309-280), which contains fix information to address this issue in J2SE and JSSE. Customers are advised to upgrade as soon as possible. Further information regarding obtaining and applying fixes can be found in the referenced advisory.

NetBSD has released an advisory (2003-001) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.

Administrators and users are advised to upgrade to version 0.9.6i or 0.9.7a. OpenPKG has released upgrade RPMs.

Conectiva has released an advisory (CLA-2003:570) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.

Debian has released an advisory (DSA 253-1) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.

Gentoo Linux have recommended that users who are running 'dev-libs/openssl' upgrade to 'openssl-0.9.6i' or 'openssl-0.9.7a' as follows:

emerge sync
emerge -u openssl
emerge clean

Mandrake has released an advisory (MDKSA-2003:020) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.

Trustix has released an advisory (TSLSA-2003-0005) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.

EnGarde has released an advisory ([ESA-20030220-005) which addresses this issue. Fix details may be found in the attached advisory.

FreeBSD has released an updated Security Advisory. Users are advised to apply the new patches or to upgrade systems via CVS. Further information is available in the referenced advisory.

OpenBSD has released security patches which address this issue. Further information is available from the OpenBSD eratta pages.

SuSE has released an advisory (SuSE-SA:2003:011) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.

Apple has released an advisory which contains a fix for this issue. Further information is available from the Apple Security Update page.

Red Hat Linux has released an advisory (RHSA-2003:062-11) containing fixes. Information about obtaining and applying fixes are available in the referenced advisory.

Sun has released updated versions of the affected products to address this issue.

Sun has also released an alert stating that this issue has been addressed in the latest release of JSSE, SDK, and JRE.

HP has released advisory HPSBUX0303-248 (rev. 1) to address this issue.

HP has released advisory HPSBUX0303-248 (rev. 2) to address this issue.

Oracle has released an advisory and patches to address this issue. User are advised to obtain patches from the Oracle metalink site listed in references.

Fixes available:


OpenBSD OpenBSD 3.2

Sun Cobalt RaQ 4

Sun Cobalt RaQ 550

Sun Cobalt RaQ XTR

Sun Cobalt Qube 3

OpenBSD OpenBSD 3.1

OpenSSL Project OpenSSL 0.9.3

OpenSSL Project OpenSSL 0.9.4

OpenSSL Project OpenSSL 0.9.5 a

OpenSSL Project OpenSSL 0.9.5

OpenSSL Project OpenSSL 0.9.6 d

OpenSSL Project OpenSSL 0.9.6 c

OpenSSL Project OpenSSL 0.9.6 e

OpenSSL Project OpenSSL 0.9.6 h

OpenSSL Project OpenSSL 0.9.6 a

OpenSSL Project OpenSSL 0.9.6

OpenSSL Project OpenSSL 0.9.6 b

OpenSSL Project OpenSSL 0.9.6 g

OpenSSL Project OpenSSL 0.9.7 beta2

OpenSSL Project OpenSSL 0.9.7 beta1

OpenSSL Project OpenSSL 0.9.7 beta3

OpenSSL Project OpenSSL 0.9.7

HP HP-UX Apache-Based Web Server 1.0 .01

Sun JSSE 1.0.3 _01

Sun JSSE 1.0.3

HP Apache-Based Web Server 1.3.27 .00

Sun SDK (Solaris Production Release) 1.4.1

Sun JRE (Solaris Production Release) 1.4.1 _02

Sun JRE (Solaris Production Release) 1.4.1

Sun SDK (Solaris Production Release) 1.4.1 _01

Sun SDK (Windows Production Release) 1.4.1

Sun JRE (Solaris Production Release) 1.4.1 _01

Sun SDK (Windows Production Release) 1.4.1 _02

Sun JRE (Windows Production Release) 1.4.1

Sun JRE (Windows Production Release) 1.4.1 _02

Sun SDK (Linux Production Release) 1.4.1

Sun SDK (Solaris Production Release) 1.4.1 _02

Sun SDK (Windows Production Release) 1.4.1 _01

Sun SDK (Linux Production Release) 1.4.1 _02

Sun JRE (Windows Production Release) 1.4.1 _01

Sun SDK (Linux Production Release) 1.4.1 _01

Apple Mac OS X 10.2.4

HP Apache-Based Web Server 2.0.43 .00

FreeBSD FreeBSD 4.6

FreeBSD FreeBSD 4.6.2

FreeBSD FreeBSD 4.7

FreeBSD FreeBSD 4.7 -STABLE

FreeBSD FreeBSD 4.8 -PRERELEASE

FreeBSD FreeBSD 5.0

Sun ONE Web Server 6.0 SP5

Sun ONE Web Server 6.0 SP4

Sun ONE Web Server 6.0

Sun ONE Web Server 6.0 SP2

Sun ONE Web Server 6.0 SP3

Sun ONE Web Server 6.0 SP1

Sun ONE Application Server 7.0 Standard Edition

Sun ONE Application Server 7.0 Platform Edition

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站