NVD

Id
17093  
Name
CVE-2016-0702  
Description
The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.  
Reject
 
CVSS Version
2  
CVSS Score
1.9  
Severity
Low  
CVSS Base Score
1.9  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-03-03  
Modified Date
2016-12-27  
Seq
2016-0702  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
94637 17093 CVE-2016-0702 http://cachebleed.info  View
94638 17093 CVE-2016-0702 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759  View
94639 17093 CVE-2016-0702 FEDORA-2016-2802690366  View
94640 17093 CVE-2016-0702 FEDORA-2016-e6807b3394  View
94641 17093 CVE-2016-0702 SUSE-SU-2016:0617  View
94642 17093 CVE-2016-0702 SUSE-SU-2016:0620  View
94643 17093 CVE-2016-0702 SUSE-SU-2016:0621  View
94644 17093 CVE-2016-0702 SUSE-SU-2016:0624  View
94645 17093 CVE-2016-0702 openSUSE-SU-2016:0627  View
94646 17093 CVE-2016-0702 openSUSE-SU-2016:0628  View
94647 17093 CVE-2016-0702 SUSE-SU-2016:0631  View
94648 17093 CVE-2016-0702 openSUSE-SU-2016:0637  View
94649 17093 CVE-2016-0702 openSUSE-SU-2016:0638  View
94650 17093 CVE-2016-0702 SUSE-SU-2016:0641  View
94651 17093 CVE-2016-0702 openSUSE-SU-2016:0720  View
94652 17093 CVE-2016-0702 SUSE-SU-2016:1057  View
94653 17093 CVE-2016-0702 openSUSE-SU-2016:1239  View
94654 17093 CVE-2016-0702 openSUSE-SU-2016:1241  View
94655 17093 CVE-2016-0702 openSUSE-SU-2016:1242  View
94656 17093 CVE-2016-0702 SUSE-SU-2016:1267  View
94657 17093 CVE-2016-0702 openSUSE-SU-2016:1273  View
94658 17093 CVE-2016-0702 SUSE-SU-2016:1290  View
94659 17093 CVE-2016-0702 SUSE-SU-2016:1360  View
94660 17093 CVE-2016-0702 openSUSE-SU-2016:1566  View
94661 17093 CVE-2016-0702 HPSBGN03563  View
94662 17093 CVE-2016-0702 http://openssl.org/news/secadv/20160301.txt  View
94663 17093 CVE-2016-0702 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016  View
94664 17093 CVE-2016-0702 DSA-3500  View
94665 17093 CVE-2016-0702 http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html  View
94666 17093 CVE-2016-0702 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
94667 17093 CVE-2016-0702 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html  View
94668 17093 CVE-2016-0702 USN-2914-1  View
94669 17093 CVE-2016-0702 https://git.openssl.org/?p=openssl.git;a=commit;h=708dc2f1291e104fe4eef810bb8ffc1fae5b19c1  View
94670 17093 CVE-2016-0702 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990  View
94671 17093 CVE-2016-0702 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168  View
94672 17093 CVE-2016-0702 GLSA-201603-15  View
94673 17093 CVE-2016-0702 https://www.openssl.org/news/secadv/20160301.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
839 JVNDB-2016-001612 OpenSSL の crypto/bn/bn_exp.c の MOD_EXP_CTIME_COPY_FROM_PREBUF 関数における RSA の鍵を取得される脆弱性 OpenSSL の crypto/bn/bn_exp.c の MOD_EXP_CTIME_COPY_FROM_PREBUF 関数は、モジュールの指数演算中のキャッシュバンクアクセス回数を適切に考慮しないため、RSA の鍵を取得される脆弱性が存在します。 CVE-2016-0702 86906 CVE-2016-0702 17093 1.9 5.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001612.html 2016-03-01 2016-11-21 View