OpenSSL: Multiple Vulnerabilities (CVE-2003-0131, CVE-2003-0147) (Linux)

OpenSSL is prone to multiple vulnerabilities.

The following vulnerabilities exist: - The SSL and TLS components for OpenSSL allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the 'Klima-Pokorny-Rosa attack'. - OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ('Karatsuba' and normal).

OpenSSL version 0.9.6 through 0.9.6i and 0.9.7 through 0.9.7a.

Checks if a vulnerable version is present on the target host.

Update OpenSSL to version 0.9.6.j, 0.9.7b or later. See the references for more details.