CVE-2009-1416: High severity gnutls vulnerability

Published Apr 30, 2009

Updated

lib/gnutlspk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.

Affected Software

7 affected components

GNU GnuTLS=2.6.1

GNU GnuTLS=2.6.0

GNU GnuTLS=2.5.0

GNU GnuTLS=2.6.2

GNU GnuTLS=2.6.3

GNU GnuTLS=2.6.5

GNU GnuTLS=2.6.4

Remediation

Patch Available

http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516

Event History

Apr 30, 2009

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1416?

CVE-2009-1416 has been rated as a high severity vulnerability due to its potential to allow remote attackers to spoof signatures.

How do I fix CVE-2009-1416?

To fix CVE-2009-1416, update GnuTLS to the latest version that is not vulnerable, specifically versions 2.6.6 or later.

What versions of GnuTLS are affected by CVE-2009-1416?

CVE-2009-1416 affects GnuTLS versions 2.5.0 through 2.6.5.

What impact can CVE-2009-1416 have on my system?

CVE-2009-1416 can allow attackers to spoof signatures on certificates, potentially leading to interception and manipulation of secure communications.

Is CVE-2009-1416 a zero-day vulnerability?

CVE-2009-1416 is not a zero-day vulnerability as it was disclosed publicly and has available fixes.