A timing based attack has been discovered in OpenSSL v0.9.6h and below which allows SSL/TLS encrypted passwords to be recovered by analyzing the timing of the responses to invalid plaintext.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/30845/secadv_20030219.txt
Source: https://packetstormsecurity.com/files/30845/secadv_20030219.txt.html