CVE-2009-1416
Vulnerability from cvelistv5
Published
2009-04-30 20:00
Modified
2024-08-07 05:13
Severity ?
Summary
lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.
References
cve@mitre.orghttp://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516Exploit, Patch
cve@mitre.orghttp://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.htmlVendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34842Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/35211
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200905-04.xml
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2009:116
cve@mitre.orghttp://www.securityfocus.com/bid/34783
cve@mitre.orghttp://www.securitytracker.com/id?1022158
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1218
af854a3a-2127-422b-91ae-364da2661108http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34842Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35211
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200905-04.xml
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2009:116
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/34783
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1022158
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1218
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:13:25.566Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[help-gnutls] 20090420 Encryption using DSA keys",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html"
          },
          {
            "name": "[gnutls-devel] 20090430 All DSA keys generated using GnuTLS 2.6.x are corrupt [GNUTLS-SA-2009-2] [CVE-2009-1416]",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516"
          },
          {
            "name": "1022158",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022158"
          },
          {
            "name": "ADV-2009-1218",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1218"
          },
          {
            "name": "34783",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34783"
          },
          {
            "name": "GLSA-200905-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200905-04.xml"
          },
          {
            "name": "34842",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34842"
          },
          {
            "name": "35211",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35211"
          },
          {
            "name": "MDVSA-2009:116",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:116"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-04-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2009-05-13T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[help-gnutls] 20090420 Encryption using DSA keys",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html"
        },
        {
          "name": "[gnutls-devel] 20090430 All DSA keys generated using GnuTLS 2.6.x are corrupt [GNUTLS-SA-2009-2] [CVE-2009-1416]",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516"
        },
        {
          "name": "1022158",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022158"
        },
        {
          "name": "ADV-2009-1218",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1218"
        },
        {
          "name": "34783",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34783"
        },
        {
          "name": "GLSA-200905-04",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200905-04.xml"
        },
        {
          "name": "34842",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34842"
        },
        {
          "name": "35211",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35211"
        },
        {
          "name": "MDVSA-2009:116",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:116"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-1416",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[help-gnutls] 20090420 Encryption using DSA keys",
              "refsource": "MLIST",
              "url": "http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html"
            },
            {
              "name": "[gnutls-devel] 20090430 All DSA keys generated using GnuTLS 2.6.x are corrupt [GNUTLS-SA-2009-2] [CVE-2009-1416]",
              "refsource": "MLIST",
              "url": "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516"
            },
            {
              "name": "1022158",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022158"
            },
            {
              "name": "ADV-2009-1218",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1218"
            },
            {
              "name": "34783",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34783"
            },
            {
              "name": "GLSA-200905-04",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200905-04.xml"
            },
            {
              "name": "34842",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34842"
            },
            {
              "name": "35211",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35211"
            },
            {
              "name": "MDVSA-2009:116",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:116"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-1416",
    "datePublished": "2009-04-30T20:00:00",
    "dateReserved": "2009-04-24T00:00:00",
    "dateUpdated": "2024-08-07T05:13:25.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2009-1416\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2009-04-30T20:30:00.577\",\"lastModified\":\"2024-11-21T01:02:24.510\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.\"},{\"lang\":\"es\",\"value\":\"lib/gnutls_pk.c en libgnutls en GnuTLS v2.5.0 hasta v2.6.5 genera claves RSA almacenados en estructuras DSA, en lugar de las claves DSA previstas, lo cual podr\u00eda permitir a atacantes remotos suplantar firmas en los certificados o tener otro impacto no especificado por el utilizamiento de una clave DSA no es v\u00e1lida.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-310\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:gnutls:2.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA9E7F22-5BC4-4AD5-A630-25947CC1E5B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:gnutls:2.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6B3DBF9-52EB-4741-85E4-E68645BD81E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:gnutls:2.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"350A6845-77D6-4D63-A13C-5DAB55F98727\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:gnutls:2.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A456D12-C43A-47B0-AC0D-BF02AEBA0828\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:gnutls:2.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D457688-987A-4059-AA58-D9BF19ABC48B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:gnutls:2.6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA20043D-EC85-4003-9E7B-27AB50F4E133\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:gnutls:2.6.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"18A2C47E-510D-4537-8F51-3763A73E8E52\"}]}]}],\"references\":[{\"url\":\"http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/34842\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35211\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-200905-04.xml\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:116\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/34783\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id?1022158\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/1218\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/34842\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35211\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-200905-04.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:116\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/34783\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id?1022158\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/1218\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"vendorComments\":[{\"organization\":\"Red Hat\",\"comment\":\"Not vulnerable. This issue did not affect versions of gnutls shipped in Red Hat Enterprise Linux 4 and 5 as it only affected gnutls 2.6.x versions.\",\"lastModified\":\"2009-09-21T00:00:00\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.