Secunia

OpenSSL has been found vulnerable to a new attack that allows malicious people to retrieve the premaster-secret, which can be used to identify the session keys used during SSL/TLS sessions. This makes it possible to decrypt the sessions. The premaster-secret is not the same as the RSA secret.

After the Bleichenbacher attack in 1998 it was decided to implement certain counter measures including a version number check in the SSL protocol. However, the version number check was badly implemented and leaks information that makes this new attack method feasible.

The attack method has been proven efficient and feasible over highspeed connections, this attack requires a few million requests to be sent to the server.

For further details please read "Original Advisory".

Solution
Upgrade to version 0.9.7b:
Further details available in Customer Area

Provided and/or discovered by
Vlastimil Klima and Ondrej Pokorny and Tomas Rosa

Changelog
Further details available in Customer Area

Original Advisory
http://eprint.iacr.org/2003/052/

Deep Links
Links available in Customer Area