Secunia

OpenSSL has been found vulnerable to a timing attack, which has been proven to be a feasible way to recover the RSA secret from systems running OpenSSL.

The problem is that various queries takes different amounts of processing time, this information can be used to guess the private key.

The attacks has been proven feasible over LANs and high speed internet connections. It is required that the load on the server is low and that the network load is low so that an attacker can measure the time differences.

This attack only requires 300.000 to 1.400.000 queries to the ssl server.

Solution
Upgrade to version 0.9.7b:
Further details available in Customer Area

Provided and/or discovered by
D. Boneh and D. Brumley

Changelog
Further details available in Customer Area

Original Advisory
http://crypto.stanford.edu/~dabo/abstracts/ssl-timing.html

Deep Links
Links available in Customer Area