Vulnerability Name:

CVE-2003-0131 (CCN-11586)

Assigned:2003-03-19
Published:2003-03-19
Updated:2018-10-19
Summary:The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Obtain Information
References:Source: CCN
Type: FreeBSD Security Advisory FreeBSD-SA-03:06.openssl
OpenSSL timing-based SSL/TLS attack

Source: NETBSD
Type: UNKNOWN
NetBSD-SA2003-007

Source: CALDERA
Type: UNKNOWN
CSSA-2003-014.0

Source: CCN
Type: SGI Security Advisory 20030501-01-I
Multiple Security Vulnerabilities in OpenSSL

Source: SGI
Type: UNKNOWN
20030501-01-I

Source: CCN
Type: BugTraq Mailing List, Wed Mar 19 2003 - 13:36:19 CST
OpenSSL Advisory] Klima-Pokorny-Rosa attack on PKCS #1 v1.5 padding

Source: MITRE
Type: CNA
CVE-2003-0131

Source: CONECTIVA
Type: UNKNOWN
CLA-2003:625

Source: CCN
Type: Conectiva Linux Security Announcement CLSA-2003:625
openssl

Source: CCN
Type: ePrint Web site
Cryptology ePrint Archive: Report 2003/052

Source: MISC
Type: Vendor Advisory
http://eprint.iacr.org/2003/052/

Source: CONFIRM
Type: UNKNOWN
http://lists.apple.com/mhonarc/security-announce/msg00028.html

Source: BUGTRAQ
Type: UNKNOWN
20030319 [OpenSSL Advisory] Klima-Pokorny-Rosa attack on PKCS #1 v1.5 padding

Source: BUGTRAQ
Type: UNKNOWN
20030324 GLSA: openssl (200303-20)

Source: TRUSTIX
Type: UNKNOWN
2003-0013

Source: CCN
Type: Oracle Security Alert #62
SSL Update for CERT CA200326 and older SSL issues

Source: CCN
Type: RHSA-2003-101
Updated OpenSSL packages fix vulnerabilities

Source: CCN
Type: RHSA-2003-102
openssl security update

Source: CCN
Type: RHSA-2003-205
Updated OpenSSL packages fix vulnerabilities

Source: DEBIAN
Type: UNKNOWN
DSA-288

Source: DEBIAN
Type: DSA-288
openssl -- several vulnerabilities

Source: GENTOO
Type: UNKNOWN
GLSA-200303-20

Source: CCN
Type: US-CERT VU#888801
SSL/TLS implementations disclose side channel information via PKCS #1 v1.5 version number extension

Source: CERT-VN
Type: Third Party Advisory, US Government Resource
VU#888801

Source: CCN
Type: EnGarde Secure Linux Security Advisory ESA-20030320-010
Several vulnerabilities in the OpenSSL toolkit.

Source: MISC
Type: UNKNOWN
http://www.linuxsecurity.com/advisories/immunix_advisory-3066.html

Source: CCN
Type: EnGarde Secure Linux Security Advisory ESA-20010426-01
There are four potential vulnerabilities in openssl.

Source: CCN
Type: Immunix Secured OS Security Advisory IMNX-2003-7+-001-01
openssl, openssh, mod_ssl

Source: CCN
Type: Trustix Secure Linux Security Advisory #2003-0013
openssl

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2003:035

Source: CCN
Type: OpenPKG-SA-2003.026
OpenSSL

Source: OPENPKG
Type: UNKNOWN
OpenPKG-SA-2003.026

Source: CCN
Type: OpenSSL Security Advisory [19 March 2003]
Klima-Pokorny-Rosa attack on RSA in SSL/TLS

Source: CONFIRM
Type: UNKNOWN
http://www.openssl.org/news/secadv_20030319.txt

Source: REDHAT
Type: UNKNOWN
RHSA-2003:101

Source: REDHAT
Type: UNKNOWN
RHSA-2003:102

Source: IMMUNIX
Type: UNKNOWN
IMNX-2003-7+-001-01

Source: BID
Type: Patch, Vendor Advisory
7148

Source: CCN
Type: BID-7148
OpenSSL Bad Version Oracle Side Channel Attack Vulnerability

Source: CCN
Type: TLSA-2003-22
The RSA key is decoded

Source: XF
Type: UNKNOWN
ssl-premaster-information-leak(11586)

Source: XF
Type: UNKNOWN
ssl-premaster-information-leak(11586)

Source: SUSE
Type: UNKNOWN
SuSE-SA:2003:024

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:461

Source: SUSE
Type: SUSE-SA:2003:024
openssl: remote private-key retrieval

Vulnerable Configuration:Configuration 1:
  • cpe:/a:openssl:openssl:0.9.6:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6a:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6b:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6c:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6d:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6e:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6g:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6h:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6i:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.7:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.7a:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:openssl:openssl:0.9.7a:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6i:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.7:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6a:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6b:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6c:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6d:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6e:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6g:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:0.9.6h:*:*:*:*:*:*:*
  • AND
  • cpe:/o:hp:hp-ux:11.00:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:6.2:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:2.2:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:5.0:-:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:1.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.11:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:8.1.7:*:*:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:engardelinux:secure_community:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:1.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:mandrakesoft:mandrake_single_network_firewall:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:6.5:*:*:*:server:*:*:*
  • OR cpe:/o:suse:suse_linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:1.5:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:engardelinux:secure_linux:-:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_linux_firewall:*:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_linux_database_server:*:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_email_server:iii:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_linux_connectivity_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:4.6:-:*:*:*:*:*:*
  • OR cpe:/o:engardelinux:secure_professional:-:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:current:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_linux_office_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:1.1:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.22:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_email_server:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*
  • OR cpe:/a:mandrakesoft:mandrake_multi_network_firewall:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux_server:6.1:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:1.2:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:6.0:*:*:*:workstation:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.3:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:4.7:-:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:sgi:irix:6.5.19:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:1.0.2.1s:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:http_server:9.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:http_server:9.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:http_server:8.1.7:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.0::ppc:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.1::ia64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.2::ppc:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.1::ppc:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20030131
    V
    		CVE-2003-0131
    2015-11-16
    oval:org.mitre.oval:def:461
    V
    		Klima-Pokorny-Rosa Attack Vulnerability
    2007-04-25
    oval:org.debian:def:288
    V
    		several vulnerabilities
    2003-04-17
    BACK
    openssl openssl 0.9.6
    openssl openssl 0.9.6a
    openssl openssl 0.9.6b
    openssl openssl 0.9.6c
    openssl openssl 0.9.6d
    openssl openssl 0.9.6e
    openssl openssl 0.9.6g
    openssl openssl 0.9.6h
    openssl openssl 0.9.6i
    openssl openssl 0.9.7
    openssl openssl 0.9.7a
    openssl openssl 0.9.7a
    openssl openssl 0.9.6i
    openssl openssl 0.9.7
    openssl openssl 0.9.6a
    openssl openssl 0.9.6
    openssl openssl 0.9.6b
    openssl openssl 0.9.6c
    openssl openssl 0.9.6d
    openssl openssl 0.9.6e
    openssl openssl 0.9.6g
    openssl openssl 0.9.6h
    hp hp-ux 11.00
    redhat linux 6.2
    debian debian linux 2.2
    freebsd freebsd 5.0
    trustix secure linux 1.1
    redhat linux 7
    hp hp-ux 11.11
    mandrakesoft mandrake linux 7.2
    oracle database server 8.1.7
    conectiva linux 6.0
    suse suse linux 7.1
    engardelinux secure community 1.0.1
    redhat linux 7.1
    trustix secure linux 1.2
    mandrakesoft mandrake linux 8.0
    mandrakesoft mandrake single network firewall 7.2
    turbolinux turbolinux server 6.5
    suse suse linux 7.2
    conectiva linux 7.0
    trustix secure linux 1.5
    mandrakesoft mandrake linux 8.1
    redhat linux 7.2
    suse suse linux 7.3
    engardelinux secure linux -
    suse suse linux firewall *
    suse suse linux database server *
    suse suse email server iii
    suse suse linux connectivity server *
    mandrakesoft mandrake linux 8.2
    suse suse linux 8.0
    conectiva linux 8.0
    redhat linux 7.3
    debian debian linux 3.0
    freebsd freebsd 4.6
    engardelinux secure professional -
    openpkg openpkg current
    oracle application server 9.0.2
    suse suse linux office server *
    redhat linux 8.0
    openpkg openpkg 1.1
    hp hp-ux 11.22
    mandrakesoft mandrake linux 9.0
    suse suse email server 3.1
    suse suse linux 8.1
    suse linux enterprise server 8
    mandrakesoft mandrake multi network firewall 8.2
    turbolinux turbolinux server 6.1
    openpkg openpkg 1.2
    turbolinux turbolinux workstation 6.0
    oracle application server 9.0.3
    freebsd freebsd 4.7
    mandrakesoft mandrake linux corporate server 2.1
    mandrakesoft mandrake linux 9.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat linux 9.0
    suse suse linux 8.2
    sgi irix 6.5.19
    oracle application server 1.0.2.2
    oracle application server 1.0.2.1s
    oracle http server 9.2.0
    oracle http server 9.0.1
    oracle http server 8.1.7
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 8.0
    mandrakesoft mandrake linux 8.1
    mandrakesoft mandrake linux 8.2
    mandrakesoft mandrake linux 9.1