NVD

CVE-2007-3108 Detail

Modified

This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.

Description

The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: 1.2 LOW

Vector: (AV:L/AC:H/Au:N/C:P/I:N/A:N)

Vendor Statements (disclaimer)

Official Statement from Red Hat (08/14/2007)

This paper describes a possible side-channel attack that hasn’t been proven outside of a lab environment. In reality many factors would make this harder to exploit. If exploited, a local user could obtain RSA private keys (for example for web sites being run on the server). We have rated this as affecting Red Hat products with moderate security severity. Although the OpenSSL team have produced a patch for this issue, it is non-trivial and will require more testing before we can deploy it in a future update. Our current plan is as follows: - To include a backported fix in an OpenSSL update as part of Enterprise Linux 4.6. This will get testing via beta and give time for more extensive internal and upstream testing - To release an update for OpenSSL for other platforms at the same time as 4.6 is released http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2007-3108

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://cvs.openssl.org/chngview?cn=16275
http://cvs.openssl.org/chngview?cn=16275
http://lists.vmware.com/pipermail/security-announce/2008/000002.html
http://lists.vmware.com/pipermail/security-announce/2008/000002.html
http://openssl.org/news/patch-CVE-2007-3108.txt
http://openssl.org/news/patch-CVE-2007-3108.txt
http://secunia.com/advisories/26411
http://secunia.com/advisories/26411
http://secunia.com/advisories/26893
http://secunia.com/advisories/26893
http://secunia.com/advisories/27021
http://secunia.com/advisories/27021
http://secunia.com/advisories/27078
http://secunia.com/advisories/27078
http://secunia.com/advisories/27097
http://secunia.com/advisories/27097
http://secunia.com/advisories/27205
http://secunia.com/advisories/27205
http://secunia.com/advisories/27330
http://secunia.com/advisories/27330
http://secunia.com/advisories/27770
http://secunia.com/advisories/27770
http://secunia.com/advisories/27870
http://secunia.com/advisories/27870
http://secunia.com/advisories/28368
http://secunia.com/advisories/28368
http://secunia.com/advisories/30161
http://secunia.com/advisories/30161
http://secunia.com/advisories/30220
http://secunia.com/advisories/30220
http://secunia.com/advisories/31467
http://secunia.com/advisories/31467
http://secunia.com/advisories/31489
http://secunia.com/advisories/31489
http://secunia.com/advisories/31531
http://secunia.com/advisories/31531
http://security.gentoo.org/glsa/glsa-200710-06.xml
http://security.gentoo.org/glsa/glsa-200710-06.xml
http://support.attachmate.com/techdocs/2374.html
http://support.attachmate.com/techdocs/2374.html
http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm
http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm
http://www.bluecoat.com/support/securityadvisories/advisory_openssl_rsa_key_reconstruction_vulnerability
http://www.bluecoat.com/support/securityadvisories/advisory_openssl_rsa_key_reconstruction_vulnerability
http://www.debian.org/security/2008/dsa-1571
http://www.debian.org/security/2008/dsa-1571
http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml
http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml
http://www.kb.cert.org/vuls/id/724968	US Government Resource
http://www.kb.cert.org/vuls/id/724968	US Government Resource
http://www.kb.cert.org/vuls/id/RGII-74KLP3
http://www.kb.cert.org/vuls/id/RGII-74KLP3
http://www.mandriva.com/security/advisories?name=MDKSA-2007:193
http://www.mandriva.com/security/advisories?name=MDKSA-2007:193
http://www.redhat.com/support/errata/RHSA-2007-0813.html
http://www.redhat.com/support/errata/RHSA-2007-0813.html
http://www.redhat.com/support/errata/RHSA-2007-0964.html
http://www.redhat.com/support/errata/RHSA-2007-0964.html
http://www.redhat.com/support/errata/RHSA-2007-1003.html
http://www.redhat.com/support/errata/RHSA-2007-1003.html
http://www.securityfocus.com/archive/1/476341/100/0/threaded
http://www.securityfocus.com/archive/1/476341/100/0/threaded
http://www.securityfocus.com/archive/1/485936/100/0/threaded
http://www.securityfocus.com/archive/1/485936/100/0/threaded
http://www.securityfocus.com/archive/1/486859/100/0/threaded
http://www.securityfocus.com/archive/1/486859/100/0/threaded
http://www.securityfocus.com/bid/25163	Patch
http://www.securityfocus.com/bid/25163	Patch
http://www.vmware.com/security/advisories/VMSA-2008-0001.html
http://www.vmware.com/security/advisories/VMSA-2008-0001.html
http://www.vmware.com/security/advisories/VMSA-2008-0013.html
http://www.vmware.com/security/advisories/VMSA-2008-0013.html
http://www.vupen.com/english/advisories/2007/2759
http://www.vupen.com/english/advisories/2007/2759
http://www.vupen.com/english/advisories/2007/4010
http://www.vupen.com/english/advisories/2007/4010
http://www.vupen.com/english/advisories/2008/0064
http://www.vupen.com/english/advisories/2008/0064
http://www.vupen.com/english/advisories/2008/2361
http://www.vupen.com/english/advisories/2008/2361
http://www.vupen.com/english/advisories/2008/2362
http://www.vupen.com/english/advisories/2008/2362
http://www.vupen.com/english/advisories/2008/2396
http://www.vupen.com/english/advisories/2008/2396
https://issues.rpath.com/browse/RPL-1613
https://issues.rpath.com/browse/RPL-1613
https://issues.rpath.com/browse/RPL-1633
https://issues.rpath.com/browse/RPL-1633
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9984
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9984
https://usn.ubuntu.com/522-1/
https://usn.ubuntu.com/522-1/

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-Other	Other	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

6 change records found show changes

CVE Modified by CVE 11/20/2024 7:32:25 PM

Action	Type	New Value
Added	Reference	http://cvs.openssl.org/chngview?cn=16275
Added	Reference	http://lists.vmware.com/pipermail/security-announce/2008/000002.html
Added	Reference	http://openssl.org/news/patch-CVE-2007-3108.txt
Added	Reference	http://secunia.com/advisories/26411
Added	Reference	http://secunia.com/advisories/26893
Added	Reference	http://secunia.com/advisories/27021
Added	Reference	http://secunia.com/advisories/27078
Added	Reference	http://secunia.com/advisories/27097
Added	Reference	http://secunia.com/advisories/27205
Added	Reference	http://secunia.com/advisories/27330
Added	Reference	http://secunia.com/advisories/27770
Added	Reference	http://secunia.com/advisories/27870
Added	Reference	http://secunia.com/advisories/28368
Added	Reference	http://secunia.com/advisories/30161
Added	Reference	http://secunia.com/advisories/30220
Added	Reference	http://secunia.com/advisories/31467
Added	Reference	http://secunia.com/advisories/31489
Added	Reference	http://secunia.com/advisories/31531
Added	Reference	http://security.gentoo.org/glsa/glsa-200710-06.xml
Added	Reference	http://support.attachmate.com/techdocs/2374.html
Added	Reference	http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm
Added	Reference	http://www.bluecoat.com/support/securityadvisories/advisory_openssl_rsa_key_reconstruction_vulnerability
Added	Reference	http://www.debian.org/security/2008/dsa-1571
Added	Reference	http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml
Added	Reference	http://www.kb.cert.org/vuls/id/724968
Added	Reference	http://www.kb.cert.org/vuls/id/RGII-74KLP3
Added	Reference	http://www.mandriva.com/security/advisories?name=MDKSA-2007:193
Added	Reference	http://www.redhat.com/support/errata/RHSA-2007-0813.html
Added	Reference	http://www.redhat.com/support/errata/RHSA-2007-0964.html
Added	Reference	http://www.redhat.com/support/errata/RHSA-2007-1003.html
Added	Reference	http://www.securityfocus.com/archive/1/476341/100/0/threaded
Added	Reference	http://www.securityfocus.com/archive/1/485936/100/0/threaded
Added	Reference	http://www.securityfocus.com/archive/1/486859/100/0/threaded
Added	Reference	http://www.securityfocus.com/bid/25163
Added	Reference	http://www.vmware.com/security/advisories/VMSA-2008-0001.html
Added	Reference	http://www.vmware.com/security/advisories/VMSA-2008-0013.html
Added	Reference	http://www.vupen.com/english/advisories/2007/2759
Added	Reference	http://www.vupen.com/english/advisories/2007/4010
Added	Reference	http://www.vupen.com/english/advisories/2008/0064
Added	Reference	http://www.vupen.com/english/advisories/2008/2361
Added	Reference	http://www.vupen.com/english/advisories/2008/2362
Added	Reference	http://www.vupen.com/english/advisories/2008/2396
Added	Reference	https://issues.rpath.com/browse/RPL-1613
Added	Reference	https://issues.rpath.com/browse/RPL-1633
Added	Reference	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9984
Added	Reference	https://usn.ubuntu.com/522-1/

CVE Modified by Red Hat, Inc. 10/16/2018 12:47:32 PM

Action	Type	Old Value	New Value
Added	Reference		http://www.securityfocus.com/archive/1/476341/100/0/threaded [No Types Assigned]
Added	Reference		http://www.securityfocus.com/archive/1/485936/100/0/threaded [No Types Assigned]
Added	Reference		http://www.securityfocus.com/archive/1/486859/100/0/threaded [No Types Assigned]
Removed	Reference	http://www.securityfocus.com/archive/1/archive/1/476341/100/0/threaded [No Types Assigned]
Removed	Reference	http://www.securityfocus.com/archive/1/archive/1/485936/100/0/threaded [No Types Assigned]
Removed	Reference	http://www.securityfocus.com/archive/1/archive/1/486859/100/0/threaded [No Types Assigned]

Quick Info

CVE Dictionary Entry:
CVE-2007-3108
NVD Published Date:
08/07/2007
NVD Last Modified:
11/20/2024
Source:
Red Hat, Inc.

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2007-3108 Detail

Description

Metrics

Vendor Statements (disclaimer)

Official Statement from Red Hat (08/14/2007)

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by CVE 11/20/2024 7:32:25 PM

CVE Modified by Red Hat, Inc. 5/13/2024 9:45:51 PM

CVE Modified by Red Hat, Inc. 10/16/2018 12:47:32 PM

CVE Modified by Red Hat, Inc. 10/03/2018 5:47:21 PM

CVE Modified by Red Hat, Inc. 10/10/2017 9:32:42 PM

Initial CVE Analysis 8/08/2007 9:16:00 AM

Quick Info