OpenPGP "chosen-ciphertext" attack could disclose encrypted message contents
| openpgp-ciphertext-message-disclosure (9849) |  Medium Risk |
Description:
Programs that use the OpenPGP format, including PGP and GNU Privacy Guard (GnuPG or GPG) could possibly allow a remote attacker to obtain portions of encrypted messages using a "chosen-ciphertext" attack. A remote attacker could send a specially-crafted message to a user who is using one of the affected encryption programs, and convince this user to decrypt the message, which could possibly allow the attacker to recover portions of the original message.
Note: Refer to the Counterpane Internet Security, Inc. paper: "Implementation of Chosen-Ciphertext Attacks against PGP and GnuPG" for more information. See References.
Platforms Affected:
- GNU, Privacy Guard 1.0
- GNU, Privacy Guard 1.0.1
- GNU, Privacy Guard 1.0.2
- GNU, Privacy Guard 1.0.3
- GNU, Privacy Guard 1.0.4
- GNU, Privacy Guard 1.0.5
- GNU, Privacy Guard 1.0.6
- GNU, Privacy Guard 1.0.7
- PGP, Freeware 7.0.3
- PGP, Personal Privacy 5.0
- PGP, Personal Privacy 5.5.3
- PGP, Personal Privacy 5.5.5
- PGP, Personal Privacy 6.0.2
- PGP, Personal Privacy 6.5
- PGP, Personal Privacy 6.5.1
- PGP, Personal Privacy 6.5.3
- PGP, Personal Privacy 6.5.8
- PGP, Personal Privacy 7.0
- PGP, Personal Privacy 7.0.3
- PGP, Personal Privacy 7.0.4
- PGP, Personal Privacy 7.1
- PGP, Personal Privacy 7.1.1
Remedy:
No remedy available as of November 22, 2008.
Consequences:
Obtain Information
References:
- BugTraq Mailing List, Mon Aug 12 2002 - 12:45:26 CDT , Implementation of Chosen-Ciphertext Attacks against PGP and GnuPG at http://archives.neohapsis.com/archives/bugtraq/2002-08/0094.html.
- Counterpane Internet Security, Inc. Web site, Implementation of Chosen-Ciphertext Attacks against PGP and GnuPG at http://www.schneier.com/paper-pgp.pdf.
- BID-5446: PGP / GnuPG Chosen Ciphertext Message Disclosure Vulnerability
Reported:
Aug 12, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net