CVE-2003-0131

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."

Los componentes SSL y TLS de OpenSSL 0.9.6i y anteriores, y 0.9.7a permite a atacantes remotos llevar a cabo una operación de clave privada RSA mediante un ataque de Bleichenbacher modificado que usa un número largo de conexiones SSL o TLS usando relleno PKCS #1 v1.5 que causa que OpenSSL filtre información sobre la la relación entre el texto cifrado y el texto plano asociado. También conocida como "ataque Klima-Pokorny-Rosa".

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2003-03-13 CVE Reserved
2003-03-19 CVE Published
2024-07-29 EPSS Updated
2024-08-08 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (25)

URL	Tag	Source
http://lists.apple.com/mhonarc/security-announce/msg00028.html	X_refsource_confirm
http://marc.info/?l=bugtraq&m=104811162730834&w=2	Mailing List
http://marc.info/?l=bugtraq&m=104852637112330&w=2	Mailing List
http://www.kb.cert.org/vuls/id/888801	Third Party Advisory
http://www.linuxsecurity.com/advisories/immunix_advisory-3066.html	X_refsource_misc
http://www.openssl.org/news/secadv_20030319.txt	X_refsource_confirm
https://exchange.xforce.ibmcloud.com/vulnerabilities/11586	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A461	Signature

URL	Date	SRC

URL	Date	SRC
http://www.securityfocus.com/bid/7148	2018-10-19

URL	Date	SRC
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-007.txt.asc	2018-10-19
ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt	2018-10-19
ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I	2018-10-19
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625	2018-10-19
http://eprint.iacr.org/2003/052	2018-10-19
http://marc.info/?l=bugtraq&m=104878215721135&w=2	2018-10-19
http://www.debian.org/security/2003/dsa-288	2018-10-19
http://www.gentoo.org/security/en/glsa/glsa-200303-20.xml	2018-10-19
http://www.mandriva.com/security/advisories?name=MDKSA-2003:035	2018-10-19
http://www.openpkg.org/security/OpenPKG-SA-2003.026-openssl.html	2018-10-19
http://www.redhat.com/support/errata/RHSA-2003-101.html	2018-10-19
http://www.redhat.com/support/errata/RHSA-2003-102.html	2018-10-19
http://www.securityfocus.com/archive/1/316577/30/25310/threaded	2018-10-19
https://lists.opensuse.org/opensuse-security-announce/2003-04/msg00005.html	2018-10-19
https://access.redhat.com/security/cve/CVE-2003-0131	2003-06-23
https://bugzilla.redhat.com/show_bug.cgi?id=1616975	2003-06-23

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.6 Search vendor "Openssl" for product "Openssl" and version "0.9.6"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.6a Search vendor "Openssl" for product "Openssl" and version "0.9.6a"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.6b Search vendor "Openssl" for product "Openssl" and version "0.9.6b"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.6c Search vendor "Openssl" for product "Openssl" and version "0.9.6c"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.6d Search vendor "Openssl" for product "Openssl" and version "0.9.6d"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.6e Search vendor "Openssl" for product "Openssl" and version "0.9.6e"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.6g Search vendor "Openssl" for product "Openssl" and version "0.9.6g"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.6h Search vendor "Openssl" for product "Openssl" and version "0.9.6h"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.6i Search vendor "Openssl" for product "Openssl" and version "0.9.6i"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.7 Search vendor "Openssl" for product "Openssl" and version "0.9.7"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				0.9.7a Search vendor "Openssl" for product "Openssl" and version "0.9.7a"		-		Affected