First published: Thu May 26 2005(Updated: )
The design of Advanced Encryption Standard (AES), aka Rijndael, allows remote attackers to recover AES keys via timing attacks on S-box lookups, which are difficult to perform in constant time in AES implementations.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
OpenSSL libcrypto | =0.9.7-beta3 | |
OpenSSL libcrypto | =0.9.6i | |
OpenSSL libcrypto | =0.9.3 | |
OpenSSL libcrypto | =0.9.7-beta2 | |
OpenSSL libcrypto | =0.9.7c | |
OpenSSL libcrypto | =0.9.6d | |
OpenSSL libcrypto | =0.9.1c | |
OpenSSL libcrypto | =0.9.6 | |
OpenSSL libcrypto | =0.9.6a | |
OpenSSL libcrypto | =0.9.4 | |
OpenSSL libcrypto | =0.9.5a | |
OpenSSL libcrypto | =0.9.6f | |
OpenSSL libcrypto | =0.9.6l | |
OpenSSL libcrypto | =0.9.6e | |
OpenSSL libcrypto | =0.9.7d | |
OpenSSL libcrypto | =0.9.7 | |
OpenSSL libcrypto | =0.9.6b | |
OpenSSL libcrypto | =0.9.7b | |
OpenSSL libcrypto | =0.9.6k | |
OpenSSL libcrypto | =0.9.6g | |
OpenSSL libcrypto | =0.9.6h | |
OpenSSL libcrypto | =0.9.7-beta1 | |
OpenSSL libcrypto | =0.9.6j | |
OpenSSL libcrypto | =0.9.7a | |
OpenSSL libcrypto | =0.9.6c | |
OpenSSL libcrypto | =0.9.6m | |
OpenSSL libcrypto | =0.9.2b | |
OpenSSL libcrypto | =0.9.5 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2005-1797 has been classified as having a moderate severity level.
To fix CVE-2005-1797, you should upgrade to a patched version of OpenSSL that mitigates timing attacks.
CVE-2005-1797 affects multiple versions of OpenSSL, including 0.9.1c through 0.9.7d.
CVE-2005-1797 exploits timing attacks specifically targeting the S-box lookups within AES implementations.
CVE-2005-1797 is a remote vulnerability that allows attackers to recover AES keys through network interactions.