1. Ubuntu Security Notices
  2. USN-348-1

USN-348-1: GnuTLS vulnerability

Publication date

19 September 2006

Overview

GnuTLS vulnerability

Releases

Details

The GnuTLS library did not sufficiently check the padding of PKCS #1
v1.5 signatures if the exponent of the public key is 3 (which is
widely used for CAs). This could be exploited to forge signatures
without the need of the secret key.

The GnuTLS library did not sufficiently check the padding of PKCS #1
v1.5 signatures if the exponent of the public key is 3 (which is
widely used for CAs). This could be exploited to forge signatures
without the need of the secret key.

Update instructions

After a standard system upgrade you need to reboot your computer to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
6.06 dapper libgnutls12 –  1.2.9-2ubuntu1.1
libgnutls11 –  1.0.16-14ubuntu1.1
5.10 breezy libgnutls11 –  1.0.16-13.1ubuntu1.2
5.04 hoary libgnutls11 –  1.0.16-13ubuntu0.3

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›