Date: Wed, 6 Sep 2006 11:12:21 +0200
From: OpenPKG <openpkg@openpkg.org.>
To: [email protected]Subject: [OpenPKG-SA-2006.018] OpenPKG Security Advisory (openssl)
Message-ID: <OpenPKG-SA-2006.018@openpkg.org.>
Reply-To: [email protected]
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Organization: The OpenPKG Project, http://www.openpkg.org/
User-Agent: Mutt/1.5.11 OpenPKG/2-STABLE
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
________________________________________________________________________
OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security/ http://www.openpkg.org[email protected][email protected]
OpenPKG-SA-2006.018 06-Sep-2006
________________________________________________________________________
Package: openssl
Vulnerability: signature verification failure
OpenPKG Specific: no
Affected Releases: Affected Packages: Corrected Packages:
OpenPKG CURRENT <= openssl-0.9.8b-20060505 >= openssl-0.9.8c-20060905
OpenPKG 2-STABLE <= openssl-0.9.8b-2.20060622 >= openssl-0.9.8c-2.20060906
OpenPKG 2.5-RELEASE <= openssl-0.9.8a-2.5.1 >= openssl-0.9.8a-2.5.2
Description:
According to a vendor security advisory [0], Daniel Bleichenbacher
described a possible attack on PKCS #1 v1.5 signatures which affects
the cryptography and SSL/TLS toolkit OpenSSL [1].
If an RSA key with exponent 3 is used it may be possible to forge
a PKCS #1 v1.5 signature signed by that key. Implementations may
incorrectly verify the certificate if they are not checking for excess
data in the RSA exponentiation result of the signature. Since there
are CAs using exponent 3 in wide use, and PKCS #1 v1.5 is used in
X.509 certificates, all software that uses OpenSSL to verify X.509
certificates is potentially vulnerable, as well as any other use of
PKCS #1 v1.5. This includes software that uses OpenSSL for SSL or TLS.
The Common Vulnerabilities and Exposures (CVE) project assigned the id
CVE-2006-4339 [2] to the problem.
________________________________________________________________________
References:
[0] http://www.openssl.org/news/secadv_20060905.txt
[1] http://www.openssl.org/
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339
________________________________________________________________________
For security reasons, this advisory was digitally signed with the
OpenPGP public key "OpenPKG <openpkg@openpkg.org.>" (ID 63C4CB9F) of the
OpenPKG project which you can retrieve from http://pgp.openpkg.org and
hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org
for details on how to verify the integrity of this advisory.
________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Comment: OpenPKG <openpkg@openpkg.org.>
iD8DBQFE/o9xgHWT4GPEy58RAn09AJ0RvSOCTihCxY4vWJdKsh9a/tpr5ACggXBe
dEOgfhj33twaWWmWa0T7zio=
=zkpQ
-----END PGP SIGNATURE-----
