Libksba Signature Verification Denial of Service Vulnerability

Bugtraq ID:	20565
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-5111
Remote:	Yes
Local:	No
Published:	Oct 16 2006 12:00AM
Updated:	Oct 18 2006 10:34PM
Credit:	Vendors released the details of this vulnerability.
Vulnerable:	Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu Ubuntu Linux 5.0 4 i386 Ubuntu Ubuntu Linux 5.0 4 amd64 S.u.S.E. libksba 0.9.12 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0
Not Vulnerable:

Libksba Signature Verification Denial of Service Vulnerability

The libksba library is prone to a denial-of-service vulnerability because it crashes when verifying a signature with a malformed X.509 certificate.

Attackers can exploit this issue to crash the KSBA library, and in turn cause various programs that depend on the library to cease functioning, effectively denying service.

The following versions are affected:

- SUSE Linux's version 0.9.12
- Ubuntu libksba8 version 0.9.9-2ubuntu0.5.04.

Other individual implementations may also be vulnerable.

Libksba Signature Verification Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Libksba Signature Verification Denial of Service Vulnerability

Solution:
The vendors have addressed this issue with updates.

Please see the references for more information.

Libksba Signature Verification Denial of Service Vulnerability

References:

• SUSE Security Summary Report SUSE-SR:2006:023 (SUSE)
  
• SUSE-SR:2006:023 (Novell)
  
• Ubuntu Security Notice USN-365-1 (Ubuntu)