CVE-2003-0078

    Dashboard / Vulnerabilities / CVE-2003-0078

    CVE-2003-0078

    Published: 3 Mar 2003Last Modified: 10 Apr 2026

    Summary:

    Details: ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."

    References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-001.txt.asc, ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I, http://marc.info/?l=bugtraq&m=104567627211904&w=2, http://marc.info/?l=bugtraq&m=104568426824439&w=2, http://marc.info/?l=bugtraq&m=104577183206905&w=2, http://www.debian.org/security/2003/dsa-253, http://www.iss.net/security_center/static/11369.php, http://www.linuxsecurity.com/advisories/engarde_advisory-2874.html, http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:020, http://www.openssl.org/news/secadv_20030219.txt, http://www.securityfocus.com/bid/6884, http://www.openssl.org/news/secadv_20030219.txt, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000570, http://www.ciac.org/ciac/bulletins/n-051.shtml, http://www.iss.net/security_center/static/11369.php, http://www.openssl.org/news/secadv_20030219.txt, http://www.osvdb.org/3945, http://www.redhat.com/support/errata/RHSA-2003-062.html, http://www.redhat.com/support/errata/RHSA-2003-063.html, http://www.redhat.com/support/errata/RHSA-2003-082.html, http://www.redhat.com/support/errata/RHSA-2003-104.html, http://www.redhat.com/support/errata/RHSA-2003-205.html, http://www.securityfocus.com/bid/6884, http://www.trustix.org/errata/2003/0005

    Affected packages

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High