CVE-2009-1416
GnuTLS 2.5.0-2.6.5 - Invalid DSA Key Generation via RSA Key Storage
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-1416. PoCs published by Miroslav Kratochvil.
AI-analyzed exploit summary This PoC demonstrates CVE-2009-1416 by generating a DSA key and checking if the 'q' parameter is weak (equal to 0x010001). If so, it indicates a vulnerable GnuTLS version.
Description
lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.
Exploits (1)
This PoC demonstrates CVE-2009-1416 by generating a DSA key and checking if the 'q' parameter is weak (equal to 0x010001). If so, it indicates a vulnerable GnuTLS version.