| Vulnerability Name: | CVE-2005-0366 (CCN-19312) | ||||||||
| Assigned: | 2005-02-11 | ||||||||
| Published: | 2005-02-11 | ||||||||
| Updated: | 2020-12-10 | ||||||||
| Summary: | The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote attackers to recover part of the plaintext via a chosen-ciphertext attack when the first 2 bytes of a message block are known, and an oracle or other mechanism is available to determine whether an integrity check failed. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||
| Vulnerability Type: | CWE-326 | ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: MITRE Type: CNA CVE-2005-0366 Source: CCN Type: Cryptology ePrint Archive: Report 2005/033 An Attack on CFB Mode Encryption As Used By OpenPGP Source: MISC Type: Third Party Advisory http://eprint.iacr.org/2005/033 Source: MISC Type: Technical Description, Third Party Advisory http://eprint.iacr.org/2005/033.pdf Source: CCN Type: SECTRACK ID: 1013166 OpenPGP CFB Mode Is Subject to Adaptive Chosen-Plaintext Attacks Source: SECTRACK Type: Third Party Advisory, VDB Entry 1013166 Source: CCN Type: GLSA-200503-29 GnuPG: OpenPGP protocol attack Source: GENTOO Type: Third Party Advisory GLSA-200503-29 Source: CCN Type: US-CERT VU#303094 OpenPGP vulnerable to chosen-ciphertext attacks in cipher feedback (CFB) mode Source: CERT-VN Type: Third Party Advisory, US Government Resource VU#303094 Source: MANDRAKE Type: Broken Link MDKSA-2005:057 Source: SUSE Type: Broken Link SUSE-SR:2005:007 Source: OSVDB Type: Broken Link 13775 Source: CCN Type: OSVDB ID: 13775 OpenPGP CFB Module Quick Check Feature Information Disclosure Source: CCN Type: PGP Web site OpenPGP flaw prompts quick fix Source: CONFIRM Type: Broken Link http://www.pgp.com/library/ctocorner/openpgp.html Source: BID Type: Third Party Advisory, VDB Entry 12529 Source: CCN Type: BID-12529 OpenPGP Cipher Feedback Mode Chosen-Ciphertext Partial Plaintext Retrieval Vulnerability Source: CCN Type: USN-170-1 gnupg vulnerability Source: XF Type: UNKNOWN openpgp-information-disclosure(19312) Source: SUSE Type: SUSE-SR:2005:007 SUSE Security Summary Report | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||