-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________
______

SCO Security Advisory

Subject: OpenLinux: Gnupg (gpg) severe bug could compromise almost all ElGamal keys
Advisory number: CSSA-2004-009.0
Issue date: 2004 March 02
Cross reference: sr888900 fz528657 erg712525 CAN-2003-0971
________________________________________________________________________
______

1. Problem Description

GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal
sign+encrypt keys using the same key component for encryption as
for signing, which allows attackers to determine the private key
from a signature.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2003-0971 to this issue.

2. Vulnerable Supported Versions

System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to gnupg-1.2.2-2.i386.rpm
OpenLinux 3.1.1 Workstation prior to gnupg-1.2.2-2.i386.rpm

3. Solution

The proper solution is to install the latest packages. Many
customers find it easier to use the Caldera System Updater, called
cupdate (or kcupdate under the KDE environment), to update these
packages rather than downloading and installing them by hand.

4. OpenLinux 3.1.1 Server

4.1 Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-009.0/RPM
S

4.2 Packages

168ed23b56488785d45e861aaef4b3cc gnupg-1.2.2-2.i386.rpm

4.3 Installation

rpm -Fvh gnupg-1.2.2-2.i386.rpm

4.4 Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-009.0/SRP
MS

4.5 Source Packages

1713a8818339c43ecd988be7015ae677 gnupg-1.2.2-2.src.rpm

5. OpenLinux 3.1.1 Workstation

5.1 Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-009.
0/RPMS

5.2 Packages

90a18da7cdd7247cf601e8bbef66c1e7 gnupg-1.2.2-2.i386.rpm

5.3 Installation

rpm -Fvh gnupg-1.2.2-2.i386.rpm

5.4 Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-009.
0/SRPMS

5.5 Source Packages

2fad8d8f3cad20a62fac0e9eb39e283b gnupg-1.2.2-2.src.rpm

6. References

Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0971

SCO security resources:
http://www.sco.com/support/security/index.html

This security fix closes SCO incidents sr888900 fz528657
erg712525.

7. Disclaimer

SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO products.

8. Acknowledgements

SCO would like to thank Phong Nguyen

________________________________________________________________________
______

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)

iD8DBQFARUhwbluZssSXDTERAjEkAKDo9I+3dH8mV+mcFxcm+Mf1UN3iNgCbB156
icQE3x3fX7Js8k2osQgRweM=
=hl26
-----END PGP SIGNATURE-----

[ reply ]