PT-2003-1085 · Gnu · Gnupg

Phong Nguyen · Published 2003-12-02 · Updated 2017-10-11 · CVE-2003-0971

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GnuPG versions 1.0.2 through 1.2.3

Description The issue concerns the creation of ElGamal type 20 keys, which are used for both signing and encryption. In affected versions, the same key component is used for encryption as for signing, allowing attackers to potentially determine the private key from a signature. This could lead to a breach of confidentiality, integrity, and availability of protected information. Exploitation of the issue can be done remotely.

Recommendations For versions 1.0.2 through 1.2.3, consider regenerating keys to ensure the encryption and signing components are distinct, until a fixed version is available. As a temporary workaround, restrict the use of ElGamal type 20 keys for sensitive operations.

Fix

Related Identifiers

BDU:2015-08014

CVE-2003-0971

DSA-429

RHSA-2003:395

Affected Products

Gnupg

References · 20

• ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000798 · Vendor Advisory
• http://novell.com/linux/security/advisories/2003_048_gpg.html · Vendor Advisory
• http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.html · Vendor Advisory
• http://debian.org/security/2004/dsa-429 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2003:109 · Vendor Advisory
• http://securityfocus.com/bid/9115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0971 · Security Note
• http://redhat.com/support/errata/RHSA-2003-395.html · Vendor Advisory
• http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000277.html · Patch
• http://redhat.com/support/errata/RHSA-2003-390.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08014 · Security Note
• http://kb.cert.org/vuls/id/940388 · Note
• http://marc.info/?l=bugtraq&m=106995769213221&w=2 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10982 · Note