libnasl CVE-2009-0125: Incorrect DSA_do_verify Return Value Check Analysis

Critical Vulnerability Information Vulnerability Report Vulnerability ID: #511517 Package Name: libnasl Vulnerability Description: libnasl: Return values of DSA_do_verify function are not properly checked Reporter: Kurt Roeckx Report Date: 2009-01-11 Severity: Normal Fixed Version: 2.2.11-1+rm Vulnerability Discussion 1. Issue with DSA_do_verify Function Problem: In , the return value of the function is incorrectly checked. The code directly uses as the condition, but the function may return or to indicate errors. In Code: Suggested Fix: 2. Security Discussion Conclusion: After discussion, developers concluded that although this is a bug, it does not pose a security risk. An attacker wishing to compromise an SSH server would be more effective by submitting a valid signature than an invalid one. Exception: No consideration was given to man-in-the-middle attacks, where an attacker could impersonate both parties and fully control the connection. 3. CVE Record CVE ID: CVE-2009-0125 CVE Assignment: The vulnerability discovered by Kurt Roeckx was eventually assigned a CVE identifier. 4. Conclusion This bug is considered a general software bug rather than a security vulnerability. However, it may pose potential risks under specific conditions (such as man-in-the-middle attacks). It has been fixed and applied in Debian version 2.2.11-1+rm.

Goal Reached Thanks to every supporter — we hit 100%!

libnasl CVE-2009-0125: Incorrect DSA_do_verify Return Value Check Analysis