Vulnerabilities > CVE-2011-3599 - Cryptographic Issues vulnerability in Adam Kennedy Crypt-Dsa

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
adam-kennedy
CWE-310
nessus
NVD
Published: 2011-10-10
Updated: 2024-11-21

Summary

The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.

Vulnerable Configurations

Part Description Count
Application
Adam_Kennedy
11
Application
Perl
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-15786.NASL
    descriptionAs taught by the
    last seen2020-03-17
    modified2013-09-13
    plugin id69858
    published2013-09-13
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69858
    titleFedora 19 : perl-Crypt-DSA-1.17-10.fc19 (2013-15786)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-15755.NASL
    descriptionAs taught by the
    last seen2020-03-17
    modified2013-09-13
    plugin id69857
    published2013-09-13
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69857
    titleFedora 18 : perl-Crypt-DSA-1.17-10.fc18 (2013-15755)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2013-241.NASL
    descriptionA vulnerability has been discovered and corrected in perl-Crypt-DSA : The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack (CVE-2011-3599). The updated packages have been patched to correct this issue.
    last seen2020-06-01
    modified2020-06-02
    plugin id70133
    published2013-09-26
    reporterThis script is Copyright (C) 2013-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/70133
    titleMandriva Linux Security Advisory : perl-Crypt-DSA (MDVSA-2013:241)

References