37055 : OpenSSL crypto/bn/bn_mont.c BN_from_montgomery Function Local RSA Key Disclosure
Printer | http://osvdb.org/37055 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
7	846	almost 6 years ago	over 2 years ago	3 times	5%

This Entry needs help! It is only 5% Complete. Click the edit link above to add more information.

Contributing is fast and easy, and benefits the entire security community.

Timeline

Disclosure Date
2007-08-13

Description

<em style='font-weight:bold;'>(Description Provided by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2007-3108" target="_blank">CVE</a>)</em> : The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.

Classification

Disclosure: Vendor Verified

Products

Unknown or Incomplete

References

CVE ID: 2007-3108 (see also: NVD)
Bugtraq ID: 25163
Secunia Advisory ID: 26411 26893 27021 27078 27097 27186 27205 27330 27770 27870 30161 30220 31467 31489 31531 40555
SCIP VulDB ID: 3704
CERT VU: 724968
VUPEN Advisory: ADV-2007-2759 ADV-2007-4010
Other Advisory URL: http://blogs.sun.com/security/entry/cve_2007_3108
http://lists.debian.org/debian-security-announce/2008/msg00152.html
http://lists.rpath.com/pipermail/security-announce/2007-August/000222.html
http://lists.rpath.com/pipermail/security-announce/2007-September/000252.html
http://support.attachmate.com/techdocs/2374.html
http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm
http://www.bluecoat.com/support/securityadvisories/advisory_openssl_rsa_key_reconstruction_vulnerability
http://www.gentoo.org/security/en/glsa/glsa-200710-06.xml
http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:193
http://www.openbsd.org/errata40.html
http://www.ubuntulinux.org/support/documentation/usn/usn-522-1
Vendor Specific News/Changelog Entry: http://cvs.openssl.org/chngview?cn=16275
http://cvs.openssl.org/chngview?cn=16275
http://openssl.org/news/patch-CVE-2007-3108.txt
http://openssl.org/news/patch-CVE-2007-3108.txt
http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm
http://www.bluecoat.com/support/securityadvisories/advisory_openssl_rsa_key_reconstruction_vulnerability
http://www.kb.cert.org/vuls/id/RGII-74KLP3
https://issues.rpath.com/browse/RPL-1613
https://issues.rpath.com/browse/RPL-1633
Vendor Specific Solution URL: http://security.gentoo.org/glsa/glsa-200710-06.xml
Vendor Specific Advisory URL: http://www.vmware.com/security/advisories/VMSA-2008-0013.html
RedHat RHSA: RHSA-2007:0813 RHSA-2007:0964 RHSA-2007:1003

Tools & Filters

	25911 26946 26950 27052 27563 27716 27777 28127 28243 40381
	4632

Credit

Unknown or Incomplete

CVSSv2 Score

CVSSv2 Base Score = 1.2
Source: nvd.nist.gov | Generated: 2007-08-08 | Disagree?

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.