SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Embedded Server/Appliance)  >   RaQ Vendors:   Sun
(Sun Issues Fix for Cobalt RaQ) GnuPG ElGamal Signature Flaw May Disclose Type 20 ElGamal Private Keys to Remote Users
SecurityTracker Alert ID:  1009082
SecurityTracker URL:  http://securitytracker.com/id/1009082
CVE Reference:   CVE-2003-0971   (Links to External Site)
Date:  Feb 17 2004
Impact:   Disclosure of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in GnuPG in the creation of ElGamal keys for digital signature. Keys used for signing can be compromised.

It is reported that Phong Nguyen discovered a flaw that allows a remote user to determine your private key within a few seconds.

In version 1.0.2 (January 2000), the flaw was introduced when the GnuPG code was modified to improve the efficiency of encryption using ElGamal keys. A common factor was used for encrypting and signing. As a result, a remtote user with access to a target user's signature can conduct a cryptographic attack to determine the target user's private key. This flaw reportedly affects only ElGamal sign+encrypt keys (type 20) in GnuPG version 1.0.2 and later.

The vendor reports that ElGamal encrypt-only keys (type 16) are not affected. Also, the DSA keys and RSA keys are not vulnerable, according to the report.

Impact:   A remote user can determine the ElGamal private key.
Solution:   Sun has issued GnuPG Security Update 1.0.1 for Cobalt RaQ, available at:

http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng/RaQXTR-All-Security-1.0.1-16674.pkg

There are reportedly no Pre-Requisites and no reboot required.

MD5 Check Sum: 6f84f67daf2b2ff766f01b88033b2307

Cause:   State error

Message History:   This archive entry is a follow-up to the message listed below.
Nov 27 2003 GnuPG ElGamal Signature Flaw May Disclose Type 20 ElGamal Private Keys to Remote Users



 Source Message Contents

Subject:  GnuPG Security Update 1.0.1


GnuPG Security Update 1.0.1

HTTP RaQXTR-All-Security-1.0.1-16674.pkg Posted:February 10, 2004:

http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng/RaQXTR-All-Security-1.0.1-16674.pkg

FTP Point your FTP client to ftp://ftp.cobalt.sun.com Size: 1,150,806

Sun states that "this package fixes a GnuPG vulnerability."

There are reportedly no Pre-Requisites and no reboot required.

MD5 Check Sum: 6f84f67daf2b2ff766f01b88033b2307


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC