CVE:CVE-2003-0078
CNNVD:CNNVD-200303-024
OpenSSL 0.9.7a之前的版本和0.9.6i之前的0.9.6版本中s3_pkt.c的ssl3_get_record如果使用不正确分组密码进行填充，将不执行MAC计算，可以导致信息泄露（时序差异），该漏洞可能更容易导致凭借区分填充和MAC检验错误差别的加密攻击，并且可能导致原始明文被提取，也称为“Vaudenay timing attack”。
solution:Upgrade openssl openssl to a higher version than 0.9.1c,0.9.2b,0.9.3,0.9.4,0.9.5,0.9.5a,0.9.6,0.9.6a,0.9.6b,0.9.6c,0.9.6d,0.9.6e,0.9.6g,0.9.6h,0.9.7,0.9.7:beta1,0.9.7:beta2,0.9.7:beta3,and avoid the version 0.9.1c,0.9.2b,0.9.3,0.9.4,0.9.5,0.9.5a,0.9.6,0.9.6a,0.9.6b,0.9.6c,0.9.6d,0.9.6e,0.9.6g,0.9.6h,0.9.7,0.9.7:beta1,0.9.7:beta2,0.9.7:beta3; Upgrade freebsd freebsd to a higher version than 4.2,4.3,4.4,4.5,4.6,4.7,4.8:pre-release,5.0,and avoid the version 4.2,4.3,4.4,4.5,4.6,4.7,4.8:pre-release,5.0; Upgrade openbsd openbsd to a higher version than 3.1,3.2,and avoid the version 3.1,3.2