bsi-2024-0001
Vulnerability from csaf_certbund
Published
2024-04-15 19:00
Modified
2024-04-15 19:00
Summary
Secret Key Recovery of NIST P-521 Private Keys through biased ECDSA nonces in PuTTY client
Notes
Legal disclaimer
As a content provider, BSI is responsible under general law for its own content distributed for use. However, it remains your responsibility to carefully check usage and/or implementation of information provided with the content.
Summary
The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.
{
"document": {
"acknowledgments": [
{
"names": [
"Fabian B\u00e4umer",
"Marcus Brinkmann"
],
"organization": "Ruhr University Bochum",
"summary": "finding and reporting the vulnerability"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "As a content provider, BSI is responsible under general law for its own content distributed for use. However, it remains your responsibility to carefully check usage and/or implementation of information provided with the content.",
"title": "Legal disclaimer"
},
{
"category": "summary",
"text": "The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.",
"title": "Summary"
}
],
"publisher": {
"category": "coordinator",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "BSI-2024-0001 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/bsi-2024-0001.json"
}
],
"title": "Secret Key Recovery of NIST P-521 Private Keys through biased ECDSA nonces in PuTTY client",
"tracking": {
"current_release_date": "2024-04-15T19:00:00.000Z",
"generator": {
"date": "2024-04-15T06:53:52.394Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.2"
}
},
"id": "BSI-2024-0001",
"initial_release_date": "2024-04-15T19:00:00.000Z",
"revision_history": [
{
"date": "2024-04-15T19:00:00.000Z",
"number": "1",
"summary": "Initial version."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=0.68|\u003c=0.80",
"product": {
"name": "PuTTY client 0.68 - 0.80",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "0.81",
"product": {
"name": "PuTTY client 0.81",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "PuTTY"
}
],
"category": "vendor",
"name": "PuTTY"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=3.24.1|\u003c=3.66.5",
"product": {
"name": "FileZilla Client 3.24.1 - 3.66.5",
"product_id": "CSAFPID-0003"
}
},
{
"category": "product_version",
"name": "3.67.0",
"product": {
"name": "FileZilla Client 3.67.0",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "FileZilla Client"
}
],
"category": "vendor",
"name": "FileZilla"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=5.9.5|\u003c=6.3.2",
"product": {
"name": "WinSCP 5.9.5 - 6.3.2",
"product_id": "CSAFPID-0005"
}
},
{
"category": "product_version",
"name": "6.3.3",
"product": {
"name": "WinSCP 6.3.3",
"product_id": "CSAFPID-0010"
}
}
],
"category": "product_name",
"name": "WinSCP"
}
],
"category": "vendor",
"name": "WinSCP"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=2.4.0.2|\u003c=2.15.0.0",
"product": {
"name": "TortoiseGit 2.4.0.2 - 2.15.0.0",
"product_id": "CSAFPID-0006"
}
},
{
"category": "product_version",
"name": "2.15.0.1",
"product": {
"name": "TortoiseGit 2.15.0.1",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "TortoiseGit"
}
],
"category": "vendor",
"name": "TortoiseGit"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=1.10.0|\u003c=1.14.6",
"product": {
"name": "TortoiseSVN 1.10.0 - 1.14.6",
"product_id": "CSAFPID-0008"
}
},
{
"category": "product_version",
"name": "1.14.7",
"product": {
"name": "TortoiseSVN 1.14.7",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "TortoiseSVN"
}
],
"category": "vendor",
"name": "TortoiseSVN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-31497",
"cwe": {
"id": "CWE-334",
"name": "Small Space of Random Values"
},
"notes": [
{
"category": "description",
"text": "The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.",
"title": "CVE description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0002",
"CSAFPID-0004",
"CSAFPID-0010",
"CSAFPID-0007",
"CSAFPID-0009"
],
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "CVE Record",
"url": "https://cveawg.mitre.org/api/cve/CVE-2024-31497"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 0.61.\nAdditionally, any key material using NIST P-521 must be revoke/discard and new keys have to be generated.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html"
},
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 3.67.0.",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://filezilla-project.org/download.php?type=client"
},
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 6.3.3.",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://winscp.net/eng/download.php"
},
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 2.15.0.1.",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://tortoisegit.org/download/"
},
{
"category": "workaround",
"date": "2024-04-15T19:00:00.000Z",
"details": "As long as there is no official patch available: Configure TortoiseSVN to use PuTTY\u0027s latest plink.exe instead of the included exe. ",
"product_ids": [
"CSAFPID-0008"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 10,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"temporalScore": 10,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
},
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.3,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"temporalScore": 8.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0003",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0008"
]
}
],
"title": "Secret Key Recovery of NIST P-521 Private Keys through biased ECDSA nonces in PuTTY client"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…