Home page logo

fulldisclosure logo Full Disclosure mailing list archives

OpenLinux: Gnupg (gpg) severe bug could compromise almost all ElGamal keys
From: please_reply_to_security () sco com
Date: Tue, 2 Mar 2004 18:57:01 -0800 (PST)

Hash: SHA1


                        SCO Security Advisory

Subject:                OpenLinux: Gnupg (gpg) severe bug could compromise almost all ElGamal keys
Advisory number:        CSSA-2004-009.0
Issue date:             2004 March 02
Cross reference:        sr888900 fz528657 erg712525 CAN-2003-0971

1. Problem Description

        GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal
        sign+encrypt keys using the same key component for encryption as
        for signing, which allows attackers to determine the private key
        from a signature. 

        The Common Vulnerabilities and Exposures project (cve.mitre.org) 
        has assigned the name CAN-2003-0971 to this issue.

2. Vulnerable Supported Versions

        System                          Package
        OpenLinux 3.1.1 Server          prior to gnupg-1.2.2-2.i386.rpm
        OpenLinux 3.1.1 Workstation     prior to gnupg-1.2.2-2.i386.rpm

3. Solution

        The proper solution is to install the latest packages. Many
        customers find it easier to use the Caldera System Updater, called
        cupdate (or kcupdate under the KDE environment), to update these
        packages rather than downloading and installing them by hand.

4. OpenLinux 3.1.1 Server

        4.1 Package Location


        4.2 Packages

        168ed23b56488785d45e861aaef4b3cc        gnupg-1.2.2-2.i386.rpm

        4.3 Installation

        rpm -Fvh gnupg-1.2.2-2.i386.rpm

        4.4 Source Package Location


        4.5 Source Packages

        1713a8818339c43ecd988be7015ae677        gnupg-1.2.2-2.src.rpm

5. OpenLinux 3.1.1 Workstation

        5.1 Package Location


        5.2 Packages

        90a18da7cdd7247cf601e8bbef66c1e7        gnupg-1.2.2-2.i386.rpm

        5.3 Installation

        rpm -Fvh gnupg-1.2.2-2.i386.rpm

        5.4 Source Package Location


        5.5 Source Packages

        2fad8d8f3cad20a62fac0e9eb39e283b        gnupg-1.2.2-2.src.rpm

6. References

        Specific references for this advisory:

        SCO security resources:

        This security fix closes SCO incidents sr888900 fz528657

7. Disclaimer

        SCO is not responsible for the misuse of any of the information
        we provide on this website and/or through our security
        advisories. Our advisories are a service to our customers intended
        to promote secure installation and use of SCO products.

8. Acknowledgements

        SCO would like to thank Phong Nguyen


Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)


Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
  • OpenLinux: Gnupg (gpg) severe bug could compromise almost all ElGamal keys please_reply_to_security (Mar 03)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]