USN-348-1: GnuTLS vulnerability

Releases

• Ubuntu 6.06
• Ubuntu 5.10
• Ubuntu 5.04

Details

The GnuTLS library did not sufficiently check the padding of PKCS #1
v1.5 signatures if the exponent of the public key is 3 (which is
widely used for CAs). This could be exploited to forge signatures
without the need of the secret key.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 6.06

• libgnutls12 - 1.2.9-2ubuntu1.1
• libgnutls11 - 1.0.16-14ubuntu1.1

Ubuntu 5.10

• libgnutls11 - 1.0.16-13.1ubuntu1.2

Ubuntu 5.04

• libgnutls11 - 1.0.16-13ubuntu0.3

After a standard system upgrade you need to reboot your computer to
effect the necessary changes.

References

• CVE-2006-4790