CVE-2009-1416
First published: Thu Apr 30 2009(Updated: )
lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GnuTLS | =2.6.1 | |
| GnuTLS | =2.6.0 | |
| GnuTLS | =2.5.0 | |
| GnuTLS | =2.6.2 | |
| GnuTLS | =2.6.3 | |
| GnuTLS | =2.6.5 | |
| GnuTLS | =2.6.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/34842
- http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html
- http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516
- http://www.securitytracker.com/id?1022158
- http://www.securityfocus.com/bid/34783
- http://www.vupen.com/english/advisories/2009/1218
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:116
- http://security.gentoo.org/glsa/glsa-200905-04.xml
- http://secunia.com/advisories/35211
Frequently Asked Questions
What is the severity of CVE-2009-1416?
CVE-2009-1416 has been rated as a high severity vulnerability due to its potential to allow remote attackers to spoof signatures.
How do I fix CVE-2009-1416?
To fix CVE-2009-1416, update GnuTLS to the latest version that is not vulnerable, specifically versions 2.6.6 or later.
What versions of GnuTLS are affected by CVE-2009-1416?
CVE-2009-1416 affects GnuTLS versions 2.5.0 through 2.6.5.
What impact can CVE-2009-1416 have on my system?
CVE-2009-1416 can allow attackers to spoof signatures on certificates, potentially leading to interception and manipulation of secure communications.
Is CVE-2009-1416 a zero-day vulnerability?
CVE-2009-1416 is not a zero-day vulnerability as it was disclosed publicly and has available fixes.
- agent/type
- agent/author
- agent/remedy
- agent/references
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/gnu
- canonical/gnutls
- version/gnutls/2.6.1
- version/gnutls/2.6.0
- version/gnutls/2.5.0
- version/gnutls/2.6.2
- version/gnutls/2.6.3
- version/gnutls/2.6.5
- version/gnutls/2.6.4