CVE-2011-1945

Severity

26%

Complexity

49%

Confidentiality

48%

The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.

The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.

CVSS 2.0 Base Score 2.6. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N).

Overview

First reported 13 years ago

2011-05-31 20:55:00

Last updated 11 years ago

2013-06-06 03:10:00

Affected Software

OpenSSL Project OpenSSL 0.9.1c

0.9.1c

OpenSSL Project OpenSSL 0.9.2b

0.9.2b

OpenSSL Project OpenSSL 0.9.3

0.9.3

OpenSSL Project OpenSSL 0.9.3a

0.9.3a

OpenSSL Project OpenSSL 0.9.4

0.9.4

OpenSSL Project OpenSSL 0.9.5

0.9.5

OpenSSL Project OpenSSL 0.9.5 Beta1

0.9.5

OpenSSL Project OpenSSL 0.9.5 Beta2

0.9.5

OpenSSL Project OpenSSL 0.9.5a

0.9.5a

OpenSSL Project OpenSSL 0.9.5a Beta1

0.9.5a

OpenSSL Project OpenSSL 0.9.5a Beta2

0.9.5a

OpenSSL Project OpenSSL 0.9.6

0.9.6

OpenSSL Project OpenSSL 0.9.6 Beta1

0.9.6

OpenSSL Project OpenSSL 0.9.6 Beta2

0.9.6

OpenSSL Project OpenSSL 0.9.6 Beta3

0.9.6

OpenSSL Project OpenSSL 0.9.6a

0.9.6a

OpenSSL Project OpenSSL 0.9.6a Beta1

0.9.6a

OpenSSL Project OpenSSL 0.9.6a Beta2

0.9.6a

OpenSSL Project OpenSSL 0.9.6a Beta3

0.9.6a

OpenSSL Project OpenSSL 0.9.6b

0.9.6b

OpenSSL Project OpenSSL 0.9.6c

0.9.6c

OpenSSL Project OpenSSL 0.9.6d

0.9.6d

OpenSSL Project OpenSSL 0.9.6e

0.9.6e

OpenSSL Project OpenSSL 0.9.6f

0.9.6f

OpenSSL Project OpenSSL 0.9.6g

0.9.6g

OpenSSL Project OpenSSL 0.9.6h

0.9.6h

OpenSSL Project OpenSSL 0.9.6i

0.9.6i

OpenSSL Project OpenSSL 0.9.6j

0.9.6j

OpenSSL Project OpenSSL 0.9.6k

0.9.6k

OpenSSL Project OpenSSL 0.9.6l

0.9.6l

OpenSSL Project OpenSSL 0.9.6m

0.9.6m

OpenSSL Project OpenSSL 0.9.7

0.9.7

OpenSSL Project OpenSSL 0.9.7 beta1

0.9.7

OpenSSL Project OpenSSL 0.9.7 beta2

0.9.7

OpenSSL Project OpenSSL 0.9.7 beta3

0.9.7

OpenSSL Project OpenSSL 0.9.7 Beta4

0.9.7

OpenSSL Project OpenSSL 0.9.7 Beta5

0.9.7

OpenSSL Project OpenSSL 0.9.7 Beta6

0.9.7

OpenSSL Project OpenSSL 0.9.7a

0.9.7a

OpenSSL Project OpenSSL 0.9.7b

0.9.7b

OpenSSL Project OpenSSL 0.9.7c

0.9.7c

OpenSSL Project OpenSSL 0.9.7d

0.9.7d

OpenSSL Project OpenSSL 0.9.7e

0.9.7e

OpenSSL Project OpenSSL 0.9.7f

0.9.7f

OpenSSL Project OpenSSL 0.9.7g

0.9.7g

OpenSSL Project OpenSSL 0.9.7h

0.9.7h

OpenSSL Project OpenSSL 0.9.7i

0.9.7i

OpenSSL Project OpenSSL 0.9.7j

0.9.7j

OpenSSL Project OpenSSL 0.9.7k

0.9.7k

OpenSSL Project OpenSSL 0.9.7l

0.9.7l

OpenSSL Project OpenSSL 0.9.7m

0.9.7m

OpenSSL Project OpenSSL 0.9.8

0.9.8

OpenSSL Project OpenSSL 0.9.8a

0.9.8a

OpenSSL Project OpenSSL 0.9.8b

0.9.8b

OpenSSL Project OpenSSL 0.9.8c

0.9.8c

OpenSSL Project OpenSSL 0.9.8d

0.9.8d

OpenSSL Project OpenSSL 0.9.8e

0.9.8e

OpenSSL Project OpenSSL 0.9.8f

0.9.8f

OpenSSL Project OpenSSL 0.9.8g

0.9.8g

OpenSSL Project OpenSSL 0.9.8h

0.9.8h

OpenSSL Project OpenSSL 0.9.8i

0.9.8i

OpenSSL Project OpenSSL 0.9.8j

0.9.8j

OpenSSL Project OpenSSL 0.9.8k

0.9.8k

OpenSSL Project OpenSSL 0.9.8l

0.9.8l

OpenSSL Project OpenSSL 0.9.8m

0.9.8m

OpenSSL Project OpenSSL 0.9.8n

0.9.8n

OpenSSL Project OpenSSL 0.9.8o

0.9.8o

OpenSSL Project OpenSSL 0.9.8p

0.9.8p

OpenSSL Project OpenSSL 1.0.0

1.0.0

OpenSSL Project OpenSSL 1.0.0 Beta1

1.0.0

OpenSSL Project OpenSSL 1.0.0 Beta2

1.0.0

OpenSSL Project OpenSSL 1.0.0 Beta3

1.0.0

OpenSSL Project OpenSSL 1.0.0 Beta4

1.0.0

OpenSSL Project OpenSSL 1.0.0 Beta5

1.0.0

OpenSSL Project OpenSSL 1.0.0a

1.0.0a

OpenSSL Project OpenSSL 1.0.0b

1.0.0b

OpenSSL Project OpenSSL 1.0.0c

1.0.0c

OpenSSL Project OpenSSL

References

http://eprint.iacr.org/2011/232.pdf

Exploit

APPLE-SA-2013-06-04-1

44935

http://support.apple.com/kb/HT5784

DSA-2309

VU#536044

US Government Resource

http://www.kb.cert.org/vuls/id/MAPG-8FENZ3

US Government Resource

MDVSA-2011:136

MDVSA-2011:137

openSUSE-SU-2011:0634

SUSE-SU-2011:0636

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.