OpenPGP CFB mode information disclosure
| openpgp-information-disclosure (19312) |  Medium Risk |
Description:
OpenPGP could allow a remote attacker to obtain sensitive information, caused by a vulnerability in the integrity ad-hoc feature. A remote attacker could use a ciphertext attack against the cipher feedback (CFB) mode using the quick check feature to obtain sensitive information in plain text. An attacker could use this vulnerability to launch further attacks against the system.
Consequences:
Obtain Information
Remedy:
As a workaround, disable the quick check feature.
For Gentoo Linux:
Upgrade to the latest version of gnupg (1.4.1 and later), as listed in Gentoo Linux Security Announcement GLSA 200503-29. See References.
For Ubuntu Linux:
Refer to USN-169-1 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- Cryptology ePrint Archive: Report 2005/033: An Attack on CFB Mode Encryption As Used By OpenPGP.
- PGP Web site: OpenPGP flaw prompts quick fix.
- BID-12529: OpenPGP Cipher Feedback Mode Chosen-Ciphertext Partial Plaintext Retrieval Vulnerability
- CVE-2005-0366: The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote attackers to recover part of the plaintext via a chosen-ciphertext attack when the first 2 bytes of a message block are known, and an oracle or other mechanism is available to determine whether an integrity check failed.
- GLSA-200503-29: GnuPG: OpenPGP protocol attack
- MDKSA-2005:057: Updated gnupg packages fix vulnerability
- OSVDB ID: 13775: OpenPGP CFB Module Quick Check Feature Information Disclosure
- SECTRACK ID: 1013166: OpenPGP CFB Mode Is Subject to Adaptive Chosen-Plaintext Attacks
- SUSE-SR:2005:007: SUSE Security Summary Report
- US-CERT VU#303094: OpenPGP vulnerable to chosen-ciphertext attacks in cipher feedback (CFB) mode
- USN-170-1: gnupg vulnerability
Platforms Affected:
- Canonical Ubuntu 4.10
- Canonical Ubuntu 5.04
- Gentoo Linux
- MandrakeSoft Mandrake Linux 10.0
- MandrakeSoft Mandrake Linux 10.0 AMD64
- MandrakeSoft Mandrake Linux 10.1
- MandrakeSoft Mandrake Linux 10.1 X86_64
- MandrakeSoft Mandrake Linux 9.2
- MandrakeSoft Mandrake Linux 9.2 AMD64
- MandrakeSoft Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 2.1
- MandrakeSoft Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 3.0
- OpenPGP OpenPGP
Reported:
Feb 11, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net