Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Linux :: Apps A-M :: hack1093.htm

Gnupg (gpg) severe bug could compromise almost all ElGamal keys (OpenLinux)
OpenLinux: Gnupg (gpg) severe bug could compromise almost all ElGamal keys

Hash: SHA1


			SCO Security Advisory

Subject:		OpenLinux: Gnupg (gpg) severe bug could compromise almost all ElGamal keys
Advisory number: 	CSSA-2004-009.0
Issue date: 		2004 March 02
Cross reference: 	sr888900 fz528657 erg712525 CAN-2003-0971

1. Problem Description

	GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal
	sign+encrypt keys using the same key component for encryption as
	for signing, which allows attackers to determine the private key
	from a signature. 

	The Common Vulnerabilities and Exposures project ( 
	has assigned the name CAN-2003-0971 to this issue.

2. Vulnerable Supported Versions

	System				Package
	OpenLinux 3.1.1 Server		prior to gnupg-1.2.2-2.i386.rpm
	OpenLinux 3.1.1 Workstation	prior to gnupg-1.2.2-2.i386.rpm

3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.

4. OpenLinux 3.1.1 Server

	4.1 Package Location 9.0/RPMS

	4.2 Packages

	168ed23b56488785d45e861aaef4b3cc	gnupg-1.2.2-2.i386.rpm

	4.3 Installation

	rpm -Fvh gnupg-1.2.2-2.i386.rpm

	4.4 Source Package Location 9.0/SRPMS

	4.5 Source Packages

	1713a8818339c43ecd988be7015ae677	gnupg-1.2.2-2.src.rpm

5. OpenLinux 3.1.1 Workstation

	5.1 Package Location 4-009.0/RPMS

	5.2 Packages

	90a18da7cdd7247cf601e8bbef66c1e7	gnupg-1.2.2-2.i386.rpm

	5.3 Installation

	rpm -Fvh gnupg-1.2.2-2.i386.rpm

	5.4 Source Package Location 4-009.0/SRPMS

	5.5 Source Packages

	2fad8d8f3cad20a62fac0e9eb39e283b	gnupg-1.2.2-2.src.rpm

6. References

	Specific references for this advisory: 

	SCO security resources: 

	This security fix closes SCO incidents sr888900 fz528657

7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.

8. Acknowledgements

	SCO would like to thank Phong Nguyen


Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH