diff -ru openssl-0.9.6i/Makefile openssl-0.9.6i-patched/Makefile
--- openssl-0.9.6i/Makefile	2003-02-19 13:45:57.000000000 +0100
+++ openssl-0.9.6i-patched/Makefile	2003-03-22 18:57:16.000000000 +0100
@@ -281,7 +281,7 @@
 	libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
 	( set -x ; ${CC} --verbose -dynamiclib -o lib$$i${SHLIB_EXT} \
 		lib$$i.a $$libs -all_load -current_version ${SHLIB_MAJOR}.${SHLIB_MINOR} \
-		-compatibility_version ${SHLIB_MAJOR}.`echo ${SHLIB_MINOR} | cut -d. -f1` \
+		-compatibility_version 0.9.6 \
 		-install_name ${INSTALLTOP}/lib/lib$$i${SHLIB_EXT} ) || exit 1; \
 	libs="$$libs -l`basename $$i${SHLIB_EXT} .dylib`"; \
 	echo "" ; \
diff -ru openssl-0.9.6i/Makefile.org openssl-0.9.6i-patched/Makefile.org
--- openssl-0.9.6i/Makefile.org	2002-11-14 13:40:49.000000000 +0100
+++ openssl-0.9.6i-patched/Makefile.org	2003-03-22 18:57:16.000000000 +0100
@@ -279,7 +279,7 @@
 	libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
 	( set -x ; ${CC} --verbose -dynamiclib -o lib$$i${SHLIB_EXT} \
 		lib$$i.a $$libs -all_load -current_version ${SHLIB_MAJOR}.${SHLIB_MINOR} \
-		-compatibility_version ${SHLIB_MAJOR}.`echo ${SHLIB_MINOR} | cut -d. -f1` \
+		-compatibility_version 0.9.6 \
 		-install_name ${INSTALLTOP}/lib/lib$$i${SHLIB_EXT} ) || exit 1; \
 	libs="$$libs -l`basename $$i${SHLIB_EXT} .dylib`"; \
 	echo "" ; \
Only in openssl-0.9.6i-patched: Makefile.org~
diff -ru openssl-0.9.6i/Makefile.ssl openssl-0.9.6i-patched/Makefile.ssl
--- openssl-0.9.6i/Makefile.ssl	2003-02-19 13:45:57.000000000 +0100
+++ openssl-0.9.6i-patched/Makefile.ssl	2003-03-22 18:57:16.000000000 +0100
@@ -281,7 +281,7 @@
 	libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
 	( set -x ; ${CC} --verbose -dynamiclib -o lib$$i${SHLIB_EXT} \
 		lib$$i.a $$libs -all_load -current_version ${SHLIB_MAJOR}.${SHLIB_MINOR} \
-		-compatibility_version ${SHLIB_MAJOR}.`echo ${SHLIB_MINOR} | cut -d. -f1` \
+		-compatibility_version 0.9.6 \
 		-install_name ${INSTALLTOP}/lib/lib$$i${SHLIB_EXT} ) || exit 1; \
 	libs="$$libs -l`basename $$i${SHLIB_EXT} .dylib`"; \
 	echo "" ; \
Only in openssl-0.9.6i-patched: Makefile.ssl~
diff -ru openssl-0.9.6i/apps/Makefile openssl-0.9.6i-patched/apps/Makefile
--- openssl-0.9.6i/apps/Makefile	2002-10-09 17:12:45.000000000 +0200
+++ openssl-0.9.6i-patched/apps/Makefile	2003-03-22 18:57:16.000000000 +0100
@@ -26,8 +26,8 @@
 
 DLIBCRYPTO=../libcrypto.a
 DLIBSSL=../libssl.a
-LIBCRYPTO=-L.. -lcrypto
-LIBSSL=-L.. -lssl
+LIBCRYPTO=$(DLIBCRYPTO)
+LIBSSL=$(DLIBSSL)
 
 PROGRAM= openssl
 
diff -ru openssl-0.9.6i/apps/Makefile.ssl openssl-0.9.6i-patched/apps/Makefile.ssl
--- openssl-0.9.6i/apps/Makefile.ssl	2002-10-09 17:12:45.000000000 +0200
+++ openssl-0.9.6i-patched/apps/Makefile.ssl	2003-03-22 18:57:16.000000000 +0100
@@ -26,8 +26,8 @@
 
 DLIBCRYPTO=../libcrypto.a
 DLIBSSL=../libssl.a
-LIBCRYPTO=-L.. -lcrypto
-LIBSSL=-L.. -lssl
+LIBCRYPTO=$(DLIBCRYPTO)
+LIBSSL=$(DLIBSSL)
 
 PROGRAM= openssl
 
diff -ru openssl-0.9.6i/crypto/rsa/rsa_eay.c openssl-0.9.6i-patched/crypto/rsa/rsa_eay.c
--- openssl-0.9.6i/crypto/rsa/rsa_eay.c	2002-11-28 09:06:23.000000000 +0100
+++ openssl-0.9.6i-patched/crypto/rsa/rsa_eay.c	2003-03-22 19:00:32.000000000 +0100
@@ -190,6 +190,25 @@
 	return(r);
 	}
 
+static int rsa_eay_blinding(RSA *rsa, BN_CTX *ctx)
+	{
+	int ret = 1;
+	CRYPTO_w_lock(CRYPTO_LOCK_RSA);
+	/* Check again inside the lock - the macro's check is racey */
+	if(rsa->blinding == NULL)
+		ret = RSA_blinding_on(rsa, ctx);
+	CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
+	return ret;
+	}
+
+#define BLINDING_HELPER(rsa, ctx, err_instr) \
+	do { \
+		if(((rsa)->flags & RSA_FLAG_BLINDING) && \
+				((rsa)->blinding == NULL) && \
+				!rsa_eay_blinding(rsa, ctx)) \
+			err_instr \
+	} while(0)
+
 /* signing */
 static int RSA_eay_private_encrypt(int flen, unsigned char *from,
 	     unsigned char *to, RSA *rsa, int padding)
@@ -234,8 +253,8 @@
 		goto err;
 		}
 
-	if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL))
-		RSA_blinding_on(rsa,ctx);
+	BLINDING_HELPER(rsa, ctx, goto err;);
+
 	if (rsa->flags & RSA_FLAG_BLINDING)
 		if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err;
 
@@ -313,8 +332,8 @@
 		goto err;
 		}
 
-	if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL))
-		RSA_blinding_on(rsa,ctx);
+	BLINDING_HELPER(rsa, ctx, goto err;);
+
 	if (rsa->flags & RSA_FLAG_BLINDING)
 		if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err;
 
Only in openssl-0.9.6i-patched/crypto/rsa: rsa_eay.c~
diff -ru openssl-0.9.6i/crypto/rsa/rsa_lib.c openssl-0.9.6i-patched/crypto/rsa/rsa_lib.c
--- openssl-0.9.6i/crypto/rsa/rsa_lib.c	2001-02-24 18:32:30.000000000 +0100
+++ openssl-0.9.6i-patched/crypto/rsa/rsa_lib.c	2003-03-22 19:00:36.000000000 +0100
@@ -71,7 +71,13 @@
 
 RSA *RSA_new(void)
 	{
-	return(RSA_new_method(NULL));
+	RSA *r=RSA_new_method(NULL);
+
+#ifndef OPENSSL_NO_FORCE_RSA_BLINDING
+	r->flags|=RSA_FLAG_BLINDING;
+#endif
+
+	return r;
 	}
 
 void RSA_set_default_method(RSA_METHOD *meth)
Only in openssl-0.9.6i-patched/crypto/rsa: rsa_lib.c~
diff -ru openssl-0.9.6i/ssl/s3_srvr.c openssl-0.9.6i-patched/ssl/s3_srvr.c
--- openssl-0.9.6i/ssl/s3_srvr.c	2002-11-29 12:31:18.000000000 +0100
+++ openssl-0.9.6i-patched/ssl/s3_srvr.c	2003-03-22 19:00:23.000000000 +0100
@@ -1425,7 +1425,7 @@
 		if (i != SSL_MAX_MASTER_KEY_LENGTH)
 			{
 			al=SSL_AD_DECODE_ERROR;
-			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
+			/* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */
 			}
 
 		if ((al == -1) && !((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff))))
@@ -1441,30 +1441,29 @@
 				(p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff))))
 				{
 				al=SSL_AD_DECODE_ERROR;
-				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
-				goto f_err;
+				/* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */
+
+				/* The Klima-Pokorny-Rosa extension of Bleichenbacher's attack
+				 * (http://eprint.iacr.org/2003/052/) exploits the version
+				 * number check as a "bad version oracle" -- an alert would
+				 * reveal that the plaintext corresponding to some ciphertext
+				 * made up by the adversary is properly formatted except
+				 * that the version number is wrong.  To avoid such attacks,
+				 * we should treat this just like any other decryption error. */
+				p[0] = (char)(int) "CAN-2003-0131 patch 2003-03-19";
 				}
 			}
 
 		if (al != -1)
 			{
-#if 0
-			goto f_err;
-#else
 			/* Some decryption failure -- use random value instead as countermeasure
 			 * against Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
-			 * (see RFC 2246, section 7.4.7.1).
-			 * But note that due to length and protocol version checking, the
-			 * attack is impractical anyway (see section 5 in D. Bleichenbacher:
-			 * "Chosen Ciphertext Attacks Against Protocols Based on the RSA
-			 * Encryption Standard PKCS #1", CRYPTO '98, LNCS 1462, pp. 1-12).
-			 */
+			 * (see RFC 2246, section 7.4.7.1). */
 			ERR_clear_error();
 			i = SSL_MAX_MASTER_KEY_LENGTH;
 			p[0] = s->client_version >> 8;
 			p[1] = s->client_version & 0xff;
 			RAND_pseudo_bytes(p+2, i-2); /* should be RAND_bytes, but we cannot work around a failure */
-#endif
 			}
 	
 		s->session->master_key_length=
Only in openssl-0.9.6i-patched/ssl: s3_srvr.c~