The GnuTLS library version prior to 1.4.4 is impacted by an RSA signature forgery vulnerability. This vulnerability, which affects applications which make use of the GnuTLS library to verify PKCS#1 signatures, allows a malicious user to make an altered PKCS#1 v1.5 signature appear to be correct thus forging the signature.

This issue is described in the following documents:

• GNUTLS-SA-2006-4 at: http://www.gnutls.org/security.html
• CVE-2006-4790 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4790

The issue described in this Sun Alert is specific to the GnuTLS library. Multiple Sun products are affected by this issue. For more details please see Sun Alert 102648 at:

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1

Note: Evolution uses the GnuTLS library and is impacted by this issue.