CVE-2003-0078: Medium severity OpenSSL OpenSSL vulnerability
ssl3getrecord in s3pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0078?
The vulnerability CVE-2003-0078 is categorized as a moderate severity issue primarily due to the risk of cryptographic attacks.
How do I fix CVE-2003-0078?
To fix CVE-2003-0078, you should upgrade OpenSSL to version 0.9.7a or later to ensure proper MAC computation.
Which versions of OpenSSL are affected by CVE-2003-0078?
CVE-2003-0078 affects OpenSSL versions before 0.9.7a and prior to 0.9.6i.
What types of attacks could be launched due to CVE-2003-0078?
CVE-2003-0078 may facilitate cryptographic attacks that rely on timing discrepancies caused by incorrect block cipher padding.
Is CVE-2003-0078 still a concern for current systems?
While CVE-2003-0078 is an older vulnerability, it remains a concern for any systems still running affected versions of OpenSSL.