An information disclosure vulnerability identified in OpenSSL (0.9.6c and newer) can be exploited by a malicious person to gain knowledge of a plaintext block used to encrypt a session.

An attacker, who is able to monitor and manipulate multiple SSL or TLS connections involving a common fixed plaintext block (eg. password), can use a certain attack vector to obtain the complete plaintext block used.

The problem is that MAC (Message Authetication Code) verification is skipped during decryption if a padding error is detected. An attacker can therefore replace some ciphertext blocks with blocks sent by legitimate SSL/TLS parties and record the time until a response is recieved. Depending on the time measured an attacker can distinguish between the two error cases.

The vulnerability is only present in the CBC ciphersuites.

Solution
Upgrade to OpenSSL 0.9.7a or to OpenSSL 0.9.6i or apply patches.
Further details available in Customer Area

Provided and/or discovered by
Brice Canvel, Alain Hiltgen, Serge Vaudenay and Martin Vuagnoux.

Changelog
Further details available in Customer Area

Original Advisory
http://www.openssl.org/news/secadv_20030219.txt

Deep Links
Links available in Customer Area