低危 openssl 边信道漏洞

CVE编号

CVE-2007-3108

利用情况

暂无

补丁情况

官方补丁

披露时间

2007-08-08
漏洞描述
OpenSS L0.9.8e和更早的加密/bn/bn_mont.c中的BN_from_montgomery函数没有正确执行Montgomery乘法,这可能允许本地用户进行侧通道攻击并检索RSA私钥。
解决建议
建议您更新当前系统或软件至最新版,完成漏洞的修复。
参考链接
http://cvs.openssl.org/chngview?cn=16275
http://lists.vmware.com/pipermail/security-announce/2008/000002.html
http://openssl.org/news/patch-CVE-2007-3108.txt
http://secunia.com/advisories/26411
http://secunia.com/advisories/26893
http://secunia.com/advisories/27021
http://secunia.com/advisories/27078
http://secunia.com/advisories/27097
http://secunia.com/advisories/27205
http://secunia.com/advisories/27330
http://secunia.com/advisories/27770
http://secunia.com/advisories/27870
http://secunia.com/advisories/28368
http://secunia.com/advisories/30161
http://secunia.com/advisories/30220
http://secunia.com/advisories/31467
http://secunia.com/advisories/31489
http://secunia.com/advisories/31531
http://security.gentoo.org/glsa/glsa-200710-06.xml
http://support.attachmate.com/techdocs/2374.html
http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm
http://www.bluecoat.com/support/securityadvisories/advisory_openssl_rsa_key_r...
http://www.debian.org/security/2008/dsa-1571
http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml
http://www.kb.cert.org/vuls/id/724968
http://www.kb.cert.org/vuls/id/RGII-74KLP3
http://www.mandriva.com/security/advisories?name=MDKSA-2007:193
http://www.redhat.com/support/errata/RHSA-2007-0813.html
http://www.redhat.com/support/errata/RHSA-2007-0964.html
http://www.redhat.com/support/errata/RHSA-2007-1003.html
http://www.securityfocus.com/archive/1/476341/100/0/threaded
http://www.securityfocus.com/archive/1/485936/100/0/threaded
http://www.securityfocus.com/archive/1/486859/100/0/threaded
http://www.securityfocus.com/bid/25163
http://www.vmware.com/security/advisories/VMSA-2008-0001.html
http://www.vmware.com/security/advisories/VMSA-2008-0013.html
http://www.vupen.com/english/advisories/2007/2759
http://www.vupen.com/english/advisories/2007/4010
http://www.vupen.com/english/advisories/2008/0064
http://www.vupen.com/english/advisories/2008/2361
http://www.vupen.com/english/advisories/2008/2362
http://www.vupen.com/english/advisories/2008/2396
https://issues.rpath.com/browse/RPL-1613
https://issues.rpath.com/browse/RPL-1633
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://usn.ubuntu.com/522-1/
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 openssl openssl * Up to
(including)
0.9.8e
运行在以下环境
系统 centos_5 openssl-devel * Up to
(excluding)
0.9.8b-8.3.el5_0.2
运行在以下环境
系统 debian_10 openssl * Up to
(excluding)
0.9.8e-6
运行在以下环境
系统 debian_11 openssl * Up to
(excluding)
0.9.8e-6
运行在以下环境
系统 debian_12 openssl * Up to
(excluding)
0.9.8e-6
运行在以下环境
系统 debian_4.0 openssl * Up to
(excluding)
0.9.8c-4etch3
运行在以下环境
系统 oracle_5 oraclelinux-release * Up to
(excluding)
0.9.8b-8.3.el5_0.2
运行在以下环境
系统 redhat_5 openssl * Up to
(excluding)
0:0.9.8b-8.3.el5_0.2
运行在以下环境
系统 suse_11 libopenssl0_9_8 * Up to
(excluding)
0.9.8h-30.27
阿里云评分
2.3
  • 攻击路径
    本地
  • 攻击复杂度
    困难
  • 权限要求
    普通权限
  • 影响范围
    有限影响
  • EXP成熟度
    未验证
  • 补丁情况
    官方补丁
  • 数据保密性
    无影响
  • 数据完整性
    无影响
  • 服务器危害
    无影响
  • 全网数量
    -
CWE-ID 漏洞类型
NVD-CWE-Other
阿里云安全产品覆盖情况