1

The application I am testing has the OpenSSL " 1.0.1e-fips" version on it.

I came across this vulnerability CVE-2016-7056 (ECDSA P-256 Key Recovery Timing Attack) and could not find a way to verify if our OpenSSL is vulnerable to this attack.I am curious to know about the way/steps to verify this vulnerability for our application.

2 Answers 2

1

Check your open ssl version openssl --version

Below are the list of affected versions.

Versions Affected: OpenSSL 1.0.1u and previous versions LibreSSL (pre 6.0 errata 16, pre 5.9 errata 33) BoringSSL pre November 2015

Mitigation: Users of OpenSSL with the affected versions should apply the patch available in the manuscript at [1].

Users of LibreSSL should apply the official patch from OpenBSD [2,3].

Users of BoringSSL should upgrade to a more recent version.

1
  • 2
    This is not answering the question how to verify wether that specific build is vulnerable.
    – Tobi Nary
    Aug 2, 2017 at 14:52
0

If you are really willing to break your neck reading lot of stuff you may find a way to PoC the CVE based on what is written on this whitepaper:

and this discussion on Seclists:

Good luck

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .