CVE-2003-0131: High severity OpenSSL OpenSSL vulnerability

Published Mar 21, 2003

Updated

The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."

Affected Software

11 affected components

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.7a

Remediation

Patch Available

http://www.securityfocus.com/bid/7148

Event History

Mar 21, 2003

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Mar 24, 2003

Data Sourced

via NVD·05:00 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2003-0131?

CVE-2003-0131 is classified as a medium to high severity vulnerability due to the potential for unauthorized access to RSA private keys.

How do I fix CVE-2003-0131?

To fix CVE-2003-0131, upgrade OpenSSL to version 0.9.7b or later, which contains the necessary patches.

Who is affected by CVE-2003-0131?

CVE-2003-0131 affects OpenSSL versions 0.9.6i and earlier, as well as 0.9.7 and 0.9.7a.

What kind of attack does CVE-2003-0131 facilitate?

CVE-2003-0131 allows attackers to perform a Bleichenbacher attack that can compromise RSA private keys through TLS or SSL connections.

Is CVE-2003-0131 still relevant today?

While CVE-2003-0131 is from 2003, its relevance persists for systems still using outdated OpenSSL versions with this vulnerability.