CVE-2007-3108: Low severity OpenSSL OpenSSL vulnerability
Published Aug 8, 2007
·Updated
The BNfrommontgomery function in crypto/bn/bnmont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.
Affected Software
1 affected component
OpenSSL OpenSSL<=0.9.8e
Remediation
Patch Available
Event History
Aug 8, 2007
CVE Published
via MITRE·01:11 AM
Data Sourced
via MITRE·01:11 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-3108?
CVE-2007-3108 has been categorized as a high-severity vulnerability due to its potential to expose RSA private keys.
2
How do I fix CVE-2007-3108?
To fix CVE-2007-3108, upgrade OpenSSL to version 0.9.8f or later.
3
What causes CVE-2007-3108?
CVE-2007-3108 is caused by improper Montgomery multiplication in the BN_from_montgomery function of OpenSSL.
4
Who is affected by CVE-2007-3108?
Local users on systems running OpenSSL versions 0.9.8e and earlier are affected by CVE-2007-3108.
5
What types of attacks can CVE-2007-3108 facilitate?
CVE-2007-3108 can facilitate side-channel attacks that allow attackers to retrieve RSA private keys.