[Forgot Password]
Login  Register Subscribe

23631

 
 

115083

 
 

97389

 
 

909

 
 

78730

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2014-0076

Date: (C)2014-06-16   (M)2017-10-27
 
CVSS Score: 1.9Access Vector: LOCAL
Exploitability Subscore: 3.4Access Complexity: MEDIUM
Impact Subscore: 2.9Authentication: NONE
 Confidentiality: PARTIAL
 Integrity: NONE
 Availability: NONE











The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.

Reference:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl
http://seclists.org/fulldisclosure/2015/Apr/5
SECUNIA-58492
SECUNIA-58727
SECUNIA-58939
SECUNIA-59040
SECUNIA-59162
SECUNIA-59175
SECUNIA-59264
SECUNIA-59300
SECUNIA-59364
SECUNIA-59374
SECUNIA-59413
SECUNIA-59438
SECUNIA-59445
SECUNIA-59450
SECUNIA-59454
SECUNIA-59490
SECUNIA-59495
SECUNIA-59514
SECUNIA-59655
SECUNIA-59721
SECUNIA-60571
BID-66363
HPSBGN03050
HPSBMU03051
HPSBMU03056
HPSBMU03057
HPSBMU03062
HPSBMU03074
HPSBMU03076
HPSBOV03047
IAVM:2013-A-0222
IAVM:2014-A-0019
IAVM:2014-A-0062
IAVM:2014-A-0087
IAVM:2014-A-0099
IAVM:2014-A-0100
IAVM:2014-B-0077
IAVM:2014-B-0085
MDVSA-2014:067
MDVSA-2015:062
SSRT101590
http://advisories.mageia.org/MGASA-2014-0165.html
http://eprint.iacr.org/2014/140
http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=2198be3483259de374f91e57d247d0fc667aef29
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
http://packetstormsecurity.com/files/131271/VMware-Security-Advisory-2015-0003.html
http://support.apple.com/kb/HT6443
http://www-01.ibm.com/support/docview.wss?uid=isg400001841
http://www-01.ibm.com/support/docview.wss?uid=isg400001843
http://www-01.ibm.com/support/docview.wss?uid=swg21673137
http://www-01.ibm.com/support/docview.wss?uid=swg21676035
http://www-01.ibm.com/support/docview.wss?uid=swg21676062
http://www-01.ibm.com/support/docview.wss?uid=swg21676092
http://www-01.ibm.com/support/docview.wss?uid=swg21676419
http://www-01.ibm.com/support/docview.wss?uid=swg21676424
http://www-01.ibm.com/support/docview.wss?uid=swg21676501
http://www-01.ibm.com/support/docview.wss?uid=swg21676655
http://www-01.ibm.com/support/docview.wss?uid=swg21677695
http://www-01.ibm.com/support/docview.wss?uid=swg21677828
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm
http://www.novell.com/support/kb/doc.php?id=7015264
http://www.novell.com/support/kb/doc.php?id=7015300
http://www.openssl.org/news/secadv_20140605.txt
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
https://bugs.gentoo.org/show_bug.cgi?id=505278
https://bugzilla.novell.com/show_bug.cgi?id=869945
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
https://kc.mcafee.com/corporate/index?page=content&id=SB10075
openSUSE-SU-2016:0640

CPE    96
cpe:/a:openssl:openssl:1.0.0h
cpe:/a:openssl:openssl:1.0.0g
cpe:/a:openssl:openssl:1.0.0j
cpe:/a:openssl:openssl:1.0.0i
...
CWE    1
CWE-310
OVAL    6
oval:org.secpod.oval:def:20062
oval:org.secpod.oval:def:21253
oval:org.secpod.oval:def:601270
oval:org.secpod.oval:def:21277
...

© 2013 SecPod Technologies