(Sun Issues Fix for Cobalt RaQ) GnuPG ElGamal Signature Flaw May Disclose Type 20 ElGamal Private Keys to Remote Users
|
|
SecurityTracker Alert ID: 1009082 |
|
SecurityTracker URL: http://securitytracker.com/id/1009082
|
|
CVE Reference:
CAN-2003-0971
(Links to External Site)
|
Date: Feb 17 2004
|
Impact:
Disclosure of authentication information
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in GnuPG in the creation of ElGamal keys for digital signature. Keys used for signing can be compromised.
It is reported that Phong Nguyen discovered a flaw that allows a remote user to determine your private key within a few seconds.
In version 1.0.2 (January 2000), the flaw was introduced when the GnuPG code was modified to improve the efficiency of encryption using ElGamal keys. A common factor was used for encrypting and signing. As a result, a remtote user with access to a target user's signature can conduct a cryptographic attack to determine the target user's private key. This flaw reportedly affects only ElGamal sign+encrypt keys (type 20) in GnuPG version 1.0.2 and later.
The vendor reports that ElGamal encrypt-only keys (type 16) are not affected. Also, the DSA keys and RSA keys are not vulnerable, according to the report.
|
Impact:
A remote user can determine the ElGamal private key.
|
Solution:
Sun has issued GnuPG Security Update 1.0.1 for Cobalt RaQ, available at:
http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng/RaQXTR-All-Security-1.0.1-16674.pkg
There are reportedly no Pre-Requisites and no reboot required.
MD5 Check Sum: 6f84f67daf2b2ff766f01b88033b2307
|
Cause:
State error
|
Underlying OS:
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Mon, 16 Feb 2004 15:55:35 -0500
Subject: GnuPG Security Update 1.0.1
|
GnuPG Security Update 1.0.1
HTTP RaQXTR-All-Security-1.0.1-16674.pkg Posted:February 10, 2004:
http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng/RaQXTR-All-Security-1.0.1-16674.pkg
FTP Point your FTP client to ftp://ftp.cobalt.sun.com Size: 1,150,806
Sun states that "this package fixes a GnuPG vulnerability."
There are reportedly no Pre-Requisites and no reboot required.
MD5 Check Sum: 6f84f67daf2b2ff766f01b88033b2307
|
|
