Unscored severity · published Mar 31, 2003
CVE-2003-0147
OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the…
–
CVSS
7.1%
EPSS
No
On KEV
Description
OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).
Exploitation
Is it being used?
Exploit prediction (EPSS)7.1% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openpkg · Openpkg
1.1; 1.2 · source: NVD
OP
Openssl · Openssl
0.9.6; 0.9.6a; 0.9.6b; 0.9.6c; 0.9.6d; 0.9.6e; +5 more · source: NVD
ST
Stunnel · Stunnel
3.7; 3.8; 3.9; 3.10; 3.11; 3.12; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-0147
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-0147
Vendor Advisory
http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0130.html
crypto.stanford.edu
http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625
marc.info
http://marc.info/?l=bugtraq&m=104766550528628&w=2
More from Openpkg
9.8
CVE-2004-0772
Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code
9.8
CVE-2002-0083
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges
7.8
CVE-2004-0940
Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via…
–
CVE-2007-5116
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by…
–
CVE-2004-0990
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary…