Vulnerable Systems:
* OpenSSL versions up to 0.9.7j and 0.9.8b.
If an RSA key with exponent 3 is used it may be possible to forge a PKCS #1 v1.5 signature signed by that key. Implementations may incorrectly verify the certificate if they are not checking for excess data in the RSA exponentiation result of the signature.
Since there are CAs using exponent 3 in wide use, and PKCS #1 v1.5 is used in X.509 certificates, all software that uses OpenSSL to verify X.509 certificates is potentially vulnerable, as well as any other use of PKCS #1 v1.5. This includes software that uses OpenSSL for SSL or TLS.
Resolve:
There are multiple ways to avoid this vulnerability. Any one of the following measures is sufficient.
1. Upgrade the OpenSSL server software.
The vulnerability is resolved in the following versions of OpenSSL:
- in the 0.9.7 branch, version 0.9.7k (or later);
- in the 0.9.8 branch, version 0.9.8c (or later).
OpenSSL 0.9.8c and OpenSSL 0.9.7k are available for download via
HTTP and FTP from the following master locations (you can find the
various FTP mirrors under http://www.openssl.org/source/mirror.html):
2. If this version upgrade is not an option at the present time, alternatively the following patch may be applied to the OpenSSL source code to resolve the problem. The patch is compatible with the 0.9.6, 0.9.7, 0.9.8, and 0.9.9 branches of OpenSSL.
