Vulnerability Assessment & Network Security Forums

If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important.  If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.

Home >> Browse Vulnerability Assessment Database >> SuSE Local Security Checks >> SUSE-SA:2003:011: openssl

Vulnerability Assessment Details

SUSE-SA:2003:011: openssl

Vulnerability Assessment Summary
Check for the version of the openssl package

Detailed Explanation for this Vulnerability Assessment

The remote host is missing the patch for the advisory SUSE-SA:2003:011 (openssl).

OpenSSL is an implementation of the Secure Sockets Layer and Transport
Layer Security protocols and provides strong cryptography for many
applications in a Linux system. It is a default package in all SUSE

A security weakness has been found, known as 'Vaudenay timing attack
on CBC', named after one of the discoverers (Brice Canvel (EPFL), Alain
Hiltgen (UBS), Serge Vaudenay (EPFL), and Martin Vuagnoux (EPFL, Ilion)).
The weakness may permit a possible hacker to obtain a plaintext data block by
observing timing differences in response to two different error cases
(cipher padding errors vs. MAC verification errors).
In order to exploit this vulnerability, the attacker has to meet certain
requirements: The network connection between client and server must be
of high quality to be able to observe timing differences, the attacker
must be able to perform a man-in-the-middle attack, the transactions
must repeatedly contain the same (encrypted) plain text block (such as
a pop password or alike), and decoding failures in the SSL layer must
not be propagated to the application that is using the SSL connection.
These exploitation conditions considerably reduce the security risk
imposed by the vulnerability. However, we recommend to completely
remedy this weakness by installing the update packages for your system
according to the following guidelines. There does not exist any temporary
workaround for this problem other than applying the update packages.

Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.

Solution :
Network Security Threat Level: Medium

Networks Security ID: 6884, 6946

Vulnerability Assessment Copyright: This script is Copyright (C) 2004 Tenable Network Security

Cables, Connectors

Lenovo ThinkServer RAID 520i PCIe Adapter
Lenovo ThinkServer RAID 520i PCIe Adapter pictureAbit BX133-RAID s370 motherboard
Abit BX133-RAID s370 motherboard  pictureLaCie 2big 6TB 2-Bay Thunderbolt 2 RAID Array
LaCie 2big 6TB 2-Bay Thunderbolt 2 RAID Array pictureLenovo ThinkSystem RAID 930-16i 4GB Flash PCIe 12Gb Adapter
Lenovo ThinkSystem RAID 930-16i 4GB Flash PCIe 12Gb Adapter picture


No Discussions have been posted on this vulnerability.