FreeBSD : nettle 3.7.2 -- fix serious ECDSA signature verify bug (80f9dbd3-8eec-11eb-b9e8-3525f51429a0)

high Nessus Plugin ID 148211

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Niels Moller reports :

I've prepared a new bug-fix release of Nettle, a low-level cryptographics library, to fix a serious bug in the function to verify ECDSA signatures. Implications include an assertion failure, which could be used for denial-of-service, when verifying signatures on the secp_224r1 and secp521_r1 curves.

Even when no assert is triggered in ecdsa_verify, ECC point multiplication may get invalid intermediate values as input, and produce incorrect results. [...] It appears difficult to construct an alleged signature that makes the function misbehave in such a way that an invalid signature is accepted as valid, but such attacks can't be ruled out without further analysis.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 148211

File Name: freebsd_pkg_80f9dbd38eec11ebb9e83525f51429a0.nasl

Version: 1.1

Type: local

Family: FreeBSD Local Security Checks

Published: 3/29/2021

Updated: 3/29/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:linux-c7-nettle, p-cpe:/a:freebsd:freebsd:nettle, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 3/27/2021

Vulnerability Publication Date: 3/21/2021

Detections

Analytics