// For flags

CVE-2007-3108

openssl: RSA side-channel attack

Severity Score

9.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.

La función BN_from_montgomery en el crypto/bn/bn_mont.c del OpenSSL 0.9.8e y anteriores, no interpreta adecuadamente la multiplicación Montgomery, lo que permite a usuarios locales llevar a cabo ataques por canal colateral (side-channel) y recuperar claves privadas RSA.

Multiple vulnerabilities have been found in AMD64 x86 emulation base libraries, the worst of which may allow remote execution of arbitrary code. Versions prior to 20140406-r1 are affected.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2007-06-07 CVE Reserved
  • 2007-08-08 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
References (48)
URL Tag Source
http://cvs.openssl.org/chngview?cn=16275 X_refsource_confirm
http://lists.vmware.com/pipermail/security-announce/2008/000002.html Mailing List
http://openssl.org/news/patch-CVE-2007-3108.txt X_refsource_confirm
http://secunia.com/advisories/26411 Third Party Advisory
http://secunia.com/advisories/26893 Third Party Advisory
http://secunia.com/advisories/27021 Third Party Advisory
http://secunia.com/advisories/27078 Third Party Advisory
http://secunia.com/advisories/27097 Third Party Advisory
http://secunia.com/advisories/27205 Third Party Advisory
http://secunia.com/advisories/27330 Third Party Advisory
http://secunia.com/advisories/27770 Third Party Advisory
http://secunia.com/advisories/27870 Third Party Advisory
http://secunia.com/advisories/28368 Third Party Advisory
http://secunia.com/advisories/30161 Third Party Advisory
http://secunia.com/advisories/30220 Third Party Advisory
http://secunia.com/advisories/31467 Third Party Advisory
http://secunia.com/advisories/31489 Third Party Advisory
http://secunia.com/advisories/31531 Third Party Advisory
http://support.attachmate.com/techdocs/2374.html X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm X_refsource_confirm
http://www.bluecoat.com/support/securityadvisories/advisory_openssl_rsa_key_reconstruction_vulnerability X_refsource_confirm
http://www.kb.cert.org/vuls/id/724968 Third Party Advisory
http://www.kb.cert.org/vuls/id/RGII-74KLP3 X_refsource_confirm
http://www.securityfocus.com/archive/1/476341/100/0/threaded Mailing List
http://www.securityfocus.com/archive/1/485936/100/0/threaded Mailing List
http://www.securityfocus.com/archive/1/486859/100/0/threaded Mailing List
http://www.vmware.com/security/advisories/VMSA-2008-0001.html X_refsource_confirm
http://www.vmware.com/security/advisories/VMSA-2008-0013.html X_refsource_confirm
http://www.vupen.com/english/advisories/2007/2759 Vdb Entry
http://www.vupen.com/english/advisories/2007/4010 Vdb Entry
http://www.vupen.com/english/advisories/2008/0064 Vdb Entry
http://www.vupen.com/english/advisories/2008/2361 Vdb Entry
http://www.vupen.com/english/advisories/2008/2362 Vdb Entry
http://www.vupen.com/english/advisories/2008/2396 Vdb Entry
https://issues.rpath.com/browse/RPL-1613 X_refsource_confirm
https://issues.rpath.com/browse/RPL-1633 X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9984 Signature
URL Date SRC
URL Date SRC
http://www.securityfocus.com/bid/25163 2018-10-16
URL Date SRC
http://security.gentoo.org/glsa/glsa-200710-06.xml 2018-10-16
http://www.debian.org/security/2008/dsa-1571 2018-10-16
http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml 2018-10-16
http://www.mandriva.com/security/advisories?name=MDKSA-2007:193 2018-10-16
http://www.redhat.com/support/errata/RHSA-2007-0813.html 2018-10-16
http://www.redhat.com/support/errata/RHSA-2007-0964.html 2018-10-16
http://www.redhat.com/support/errata/RHSA-2007-1003.html 2018-10-16
https://usn.ubuntu.com/522-1 2018-10-16
https://access.redhat.com/security/cve/CVE-2007-3108 2007-11-15
https://bugzilla.redhat.com/show_bug.cgi?id=245732 2007-11-15
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Openssl
Search vendor "Openssl"
 Openssl
Search vendor "Openssl" for product "Openssl"
 <= 0.9.8e
Search vendor "Openssl" for product "Openssl" and version " <= 0.9.8e"
-
Affected