Bleichenbacher signature attack in libtomcrypt
Summary
DLA-612-1: libtomcrypt - security update. Affects libtomcrypt versions < 1.17-3.2+deb7u1. Fixed in 1.17-3.2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtomcrypt is a cryptographic library that provides various cryptographic algorithms and protocols. It is commonly used for encryption, decryption, digital signatures, and other cryptographic operations. However, a vulnerability has been discovered in the implementation of RSA signature verification in libtomcrypt.
Vulnerability Detail
The vulnerability in libtomcrypt is related to the RSA signature verification process. If an RSA key with exponent 3 is used, it is possible to forge a PKCS#1 v1.5 signature signed by that key. This vulnerability can be exploited by an attacker to bypass signature verification and potentially perform unauthorized actions.
How To Fix
Minimum fixed version
1.17-3.2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libtomcryptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to ensure the integrity and security of the cryptographic operations performed using libtomcrypt.
Conclusion
The Bleichenbacher signature attack vulnerability in libtomcrypt can be mitigated by upgrading to the latest version of the package. It is crucial to apply the security update to protect against potential unauthorized actions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libtomcrypt →
FAQ
libtomcrypt is a cryptographic library that provides various cryptographic algorithms and protocols.
The vulnerability allows an attacker to forge a PKCS#1 v1.5 signature, potentially bypassing signature verification.
To fix this vulnerability, upgrade the libtomcrypt package to version 1.17-3.2+deb7u1 or later.
No, there is no known workaround. Applying the security update is the recommended solution.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for libtomcrypt.
