CVE-2003-0078 | Vulnetix

CVE-2003-0078 PUBLISHED CVSS 5 MEDIUM

ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."

EPSS 13.72% · 96.3th percentile

Risk Scores

CVSS 2.0

EPSS Score

13.72%

96.3th percentile

Affected Products

Vendor	Product	Versions
openbsd	openbsd	3.2, 3.1
n/a	n/a	*
freebsd	freebsd	4.3, 4.4, 4.5
openssl	openssl	0.9.7, 0.9.7, 0.9.7

Timeline

Mar 3, 2003 CVE Published
Feb 4, 2022 EPSS Score
May 21, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Oct 27, 2022 EPSS Score
Dec 19, 2022 EPSS Score
Mar 7, 2023 EPSS Score
Apr 3, 2023 EPSS Score
Jul 18, 2023 EPSS Score
Sep 8, 2023 EPSS Score
Dec 23, 2023 EPSS Score
Feb 14, 2024 EPSS Score

References

2003-0005 vendor-advisory
ESA-20030220-005 vendor-advisory
20030219 OpenSSL 0.9.7a and 0.9.6i released mailing-list
RHSA-2003:082 vendor-advisory
RHSA-2003:062 vendor-advisory
DSA-253 vendor-advisory
N-051 third-party-advisory
RHSA-2003:104 vendor-advisory
NetBSD-SA2003-001 vendor-advisory
CLSA-2003:570 vendor-advisory
20030219 [OpenPKG-SA-2003.013] OpenPKG Security Advisory (openssl) mailing-list
GLSA-200302-10 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2003-0078 advisory
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:020 url
http://www.openssl.org/news/secadv_20030219.txt url
http://www.redhat.com/support/errata/RHSA-2003-205.html url
ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I technical
http://www.iss.net/security_center/static/11369.php technical
http://www.redhat.com/support/errata/RHSA-2003-063.html technical
http://www.securityfocus.com/bid/6884 technical

…and 1 more

Open in Interactive Console →