CVE ID:	CVE-2003-0147
Description:	OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).
Test IDs:	1.3.6.1.4.1.25623.1.0.53361
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0147 http://www.securityfocus.com/archive/1/316165/30/25370/threaded Bugtraq: 20030313 Vulnerability in OpenSSL (Google Search) http://marc.info/?l=bugtraq&m=104766550528628&w=2 Bugtraq: 20030317 [ADVISORY] Timing Attack on OpenSSL (Google Search) http://marc.info/?l=bugtraq&m=104792570615648&w=2 Bugtraq: 20030320 [OpenPKG-SA-2003.026] OpenPKG Security Advisory (openssl) (Google Search) http://marc.info/?l=bugtraq&m=104819602408063&w=2 Bugtraq: 20030325 Fwd: APPLE-SA-2003-03-24 Samba, OpenSSL (Google Search) http://www.securityfocus.com/archive/1/316165/30/25370/threaded Bugtraq: 20030327 Immunix Secured OS 7+ openssl update (Google Search) http://www.securityfocus.com/archive/1/316577/30/25310/threaded Caldera Security Advisory: CSSA-2003-014.0 ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt CERT/CC vulnerability note: VU#997481 http://www.kb.cert.org/vuls/id/997481 Conectiva Linux advisory: CLA-2003:625 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625 Debian Security Information: DSA-288 (Google Search) http://www.debian.org/security/2003/dsa-288 En Garde Linux Advisory: ESA-20030320-010 FreeBSD Security Advisory: FreeBSD-SA-03:06 http://marc.info/?l=bugtraq&m=104829040921835&w=2 http://www.gentoo.org/security/en/glsa/glsa-200303-23.xml http://marc.info/?l=bugtraq&m=104861762028637&w=2 Immunix Linux Advisory: IMNX-2003-7+-001-01 http://www.securityfocus.com/archive/1/316577/30/25310/threaded http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:035 http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.019.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A466 RedHat Security Advisories: RHSA-2003:101 http://www.redhat.com/support/errata/RHSA-2003-101.html RedHat Security Advisories: RHSA-2003:102 http://www.redhat.com/support/errata/RHSA-2003-102.html RedHat Security Advisories: RHSA-2003:205 SGI Security Advisory: 20030501-01-I ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0130.html