Skip to Content.
Sympa Menu

sm-security - [SM-Security] [SMGLSA-2006:6] gnupg: False positive signature verification

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: George Sherwood <pilot AT beernabeer.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] [SMGLSA-2006:6] gnupg: False positive signature verification
  • Date: Wed, 15 Feb 2006 17:08:56 -0500

Summary
============
The Gentoo project identified a security related bug in GnuPG. When
using any current version of GnuPG for unattended signature
verification (e.g. by scripts and mail programs), false positive
signature verification of detached signatures may occur.

This problem affects the tool *gpgv*, as well as using "gpg --verify"
to imitate gpgv, if only the exit code of the process is used to
decide whether a detached signature is valid. This is a plausible
mode of operation for gpgv.

If, as suggested, the --status-fd generated output is used to decide
whether a signature is valid, no problem exists. In particular
applications making use of the GPGME library[2] are not affected.

To solve this problem an update of the current stable version has been
released (see below).

Impact
======
By sending a malicious attachment to a mail server that is hooked with
clamav, a remote attacker could cause a Denial of Service or the
execution of arbitrary code.

Solution:
=========

Update GnuPG as soon as possible to version 1.4.2.1. There are no
fixes for older versions available.

Resolution
==========
All gnupg users should upgrade to the latest available version:
# scribe update
# cast -c gnupg

References
============
http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html









  • [SM-Security] [SMGLSA-2006:6] gnupg: False positive signature verification, George Sherwood, 02/15/2006

Archive powered by MHonArc 2.6.24.

Top of Page