CVE - CVE-2007-3108

CVE-ID
CVE-2007-3108	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:20070813 FLEA-2007-0043-1 openssl URL:http://www.securityfocus.com/archive/1/476341/100/0/threaded MISC:20080108 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages URL:http://www.securityfocus.com/archive/1/485936/100/0/threaded MISC:20080123 UPDATED VMSA-2008-0001.1 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages URL:http://www.securityfocus.com/archive/1/486859/100/0/threaded MISC:25163 URL:http://www.securityfocus.com/bid/25163 MISC:26411 URL:http://secunia.com/advisories/26411 MISC:26893 URL:http://secunia.com/advisories/26893 MISC:27021 URL:http://secunia.com/advisories/27021 MISC:27078 URL:http://secunia.com/advisories/27078 MISC:27097 URL:http://secunia.com/advisories/27097 MISC:27205 URL:http://secunia.com/advisories/27205 MISC:27330 URL:http://secunia.com/advisories/27330 MISC:27770 URL:http://secunia.com/advisories/27770 MISC:27870 URL:http://secunia.com/advisories/27870 MISC:28368 URL:http://secunia.com/advisories/28368 MISC:30161 URL:http://secunia.com/advisories/30161 MISC:30220 URL:http://secunia.com/advisories/30220 MISC:31467 URL:http://secunia.com/advisories/31467 MISC:31489 URL:http://secunia.com/advisories/31489 MISC:31531 URL:http://secunia.com/advisories/31531 MISC:ADV-2007-2759 URL:~~http://www.vupen.com/english/advisories/2007/2759~~ (Obsolete source) MISC:ADV-2007-4010 URL:~~http://www.vupen.com/english/advisories/2007/4010~~ (Obsolete source) MISC:ADV-2008-0064 URL:~~http://www.vupen.com/english/advisories/2008/0064~~ (Obsolete source) MISC:ADV-2008-2361 URL:~~http://www.vupen.com/english/advisories/2008/2361~~ (Obsolete source) MISC:ADV-2008-2362 URL:~~http://www.vupen.com/english/advisories/2008/2362~~ (Obsolete source) MISC:ADV-2008-2396 URL:~~http://www.vupen.com/english/advisories/2008/2396~~ (Obsolete source) MISC:DSA-1571 URL:http://www.debian.org/security/2008/dsa-1571 MISC:GLSA-200710-06 URL:http://security.gentoo.org/glsa/glsa-200710-06.xml MISC:GLSA-200805-07 URL:http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml MISC:MDKSA-2007:193 URL:~~http://www.mandriva.com/security/advisories?name=MDKSA-2007:193~~ (Obsolete source) MISC:RHSA-2007:0813 URL:http://www.redhat.com/support/errata/RHSA-2007-0813.html MISC:RHSA-2007:0964 URL:http://www.redhat.com/support/errata/RHSA-2007-0964.html MISC:RHSA-2007:1003 URL:http://www.redhat.com/support/errata/RHSA-2007-1003.html MISC:USN-522-1 URL:https://usn.ubuntu.com/522-1/ MISC:VU#724968 URL:http://www.kb.cert.org/vuls/id/724968 MISC:[Security-announce] 20080107 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages URL:http://lists.vmware.com/pipermail/security-announce/2008/000002.html MISC:http://cvs.openssl.org/chngview?cn=16275 URL:http://cvs.openssl.org/chngview?cn=16275 MISC:http://openssl.org/news/patch-CVE-2007-3108.txt URL:http://openssl.org/news/patch-CVE-2007-3108.txt MISC:http://support.attachmate.com/techdocs/2374.html URL:http://support.attachmate.com/techdocs/2374.html MISC:http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm URL:http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm MISC:http://www.bluecoat.com/support/securityadvisories/advisory_openssl_rsa_key_reconstruction_vulnerability URL:http://www.bluecoat.com/support/securityadvisories/advisory_openssl_rsa_key_reconstruction_vulnerability MISC:http://www.kb.cert.org/vuls/id/RGII-74KLP3 URL:http://www.kb.cert.org/vuls/id/RGII-74KLP3 MISC:http://www.vmware.com/security/advisories/VMSA-2008-0001.html URL:http://www.vmware.com/security/advisories/VMSA-2008-0001.html MISC:http://www.vmware.com/security/advisories/VMSA-2008-0013.html URL:http://www.vmware.com/security/advisories/VMSA-2008-0013.html MISC:https://issues.rpath.com/browse/RPL-1613 URL:https://issues.rpath.com/browse/RPL-1613 MISC:https://issues.rpath.com/browse/RPL-1633 URL:https://issues.rpath.com/browse/RPL-1633 MISC:oval:org.mitre.oval:def:9984 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9984
Assigning CNA
Red Hat, Inc.
Date Record Created
20070607	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20070607)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)