BSI-2024-0001
Vulnerability from csaf_certbund - Published: 2024-04-15 19:00 - Updated: 2024-04-15 19:00Summary
Secret Key Recovery of NIST P-521 Private Keys through biased ECDSA nonces in PuTTY client
Notes
Legal disclaimer: As a content provider, BSI is responsible under general law for its own content distributed for use. However, it remains your responsibility to carefully check usage and/or implementation of information provided with the content.
Summary: The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.
The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.
10 (Critical)
8.2 (High)
Vendor Fix
Update to the latest version of the product. At least version 0.61.
Additionally, any key material using NIST P-521 must be revoke/discard and new keys have to be generated.
https://www.chiark.greenend.org.uk/~sgtatham/putt…
Vendor Fix
Update to the latest version of the product. At least version 3.67.0.
https://filezilla-project.org/download.php?type=client
Vendor Fix
Update to the latest version of the product. At least version 6.3.3.
https://winscp.net/eng/download.php
Vendor Fix
Update to the latest version of the product. At least version 2.15.0.1.
https://tortoisegit.org/download/
Workaround
As long as there is no official patch available: Configure TortoiseSVN to use PuTTY's latest plink.exe instead of the included exe.
References
| URL | Category | |
|---|---|---|
Acknowledgments
Ruhr University Bochum
Fabian Bäumer
Marcus Brinkmann
{
"document": {
"acknowledgments": [
{
"names": [
"Fabian B\u00e4umer",
"Marcus Brinkmann"
],
"organization": "Ruhr University Bochum",
"summary": "finding and reporting the vulnerability"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "As a content provider, BSI is responsible under general law for its own content distributed for use. However, it remains your responsibility to carefully check usage and/or implementation of information provided with the content.",
"title": "Legal disclaimer"
},
{
"category": "summary",
"text": "The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.",
"title": "Summary"
}
],
"publisher": {
"category": "coordinator",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "BSI-2024-0001 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/bsi-2024-0001.json"
}
],
"title": "Secret Key Recovery of NIST P-521 Private Keys through biased ECDSA nonces in PuTTY client",
"tracking": {
"current_release_date": "2024-04-15T19:00:00.000Z",
"generator": {
"date": "2024-04-15T06:53:52.394Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.2"
}
},
"id": "BSI-2024-0001",
"initial_release_date": "2024-04-15T19:00:00.000Z",
"revision_history": [
{
"date": "2024-04-15T19:00:00.000Z",
"number": "1",
"summary": "Initial version."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=0.68|\u003c=0.80",
"product": {
"name": "PuTTY client 0.68 - 0.80",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "0.81",
"product": {
"name": "PuTTY client 0.81",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "PuTTY"
}
],
"category": "vendor",
"name": "PuTTY"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=3.24.1|\u003c=3.66.5",
"product": {
"name": "FileZilla Client 3.24.1 - 3.66.5",
"product_id": "CSAFPID-0003"
}
},
{
"category": "product_version",
"name": "3.67.0",
"product": {
"name": "FileZilla Client 3.67.0",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "FileZilla Client"
}
],
"category": "vendor",
"name": "FileZilla"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=5.9.5|\u003c=6.3.2",
"product": {
"name": "WinSCP 5.9.5 - 6.3.2",
"product_id": "CSAFPID-0005"
}
},
{
"category": "product_version",
"name": "6.3.3",
"product": {
"name": "WinSCP 6.3.3",
"product_id": "CSAFPID-0010"
}
}
],
"category": "product_name",
"name": "WinSCP"
}
],
"category": "vendor",
"name": "WinSCP"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=2.4.0.2|\u003c=2.15.0.0",
"product": {
"name": "TortoiseGit 2.4.0.2 - 2.15.0.0",
"product_id": "CSAFPID-0006"
}
},
{
"category": "product_version",
"name": "2.15.0.1",
"product": {
"name": "TortoiseGit 2.15.0.1",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "TortoiseGit"
}
],
"category": "vendor",
"name": "TortoiseGit"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=1.10.0|\u003c=1.14.6",
"product": {
"name": "TortoiseSVN 1.10.0 - 1.14.6",
"product_id": "CSAFPID-0008"
}
},
{
"category": "product_version",
"name": "1.14.7",
"product": {
"name": "TortoiseSVN 1.14.7",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "TortoiseSVN"
}
],
"category": "vendor",
"name": "TortoiseSVN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-31497",
"cwe": {
"id": "CWE-334",
"name": "Small Space of Random Values"
},
"notes": [
{
"category": "description",
"text": "The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.",
"title": "CVE description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0002",
"CSAFPID-0004",
"CSAFPID-0010",
"CSAFPID-0007",
"CSAFPID-0009"
],
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "CVE Record",
"url": "https://cveawg.mitre.org/api/cve/CVE-2024-31497"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 0.61.\nAdditionally, any key material using NIST P-521 must be revoke/discard and new keys have to be generated.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html"
},
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 3.67.0.",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://filezilla-project.org/download.php?type=client"
},
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 6.3.3.",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://winscp.net/eng/download.php"
},
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 2.15.0.1.",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://tortoisegit.org/download/"
},
{
"category": "workaround",
"date": "2024-04-15T19:00:00.000Z",
"details": "As long as there is no official patch available: Configure TortoiseSVN to use PuTTY\u0027s latest plink.exe instead of the included exe. ",
"product_ids": [
"CSAFPID-0008"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 10,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"temporalScore": 10,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
},
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.3,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"temporalScore": 8.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0003",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0008"
]
}
],
"title": "Secret Key Recovery of NIST P-521 Private Keys through biased ECDSA nonces in PuTTY client"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…