PT-2001-1030 · Gnu · Gnupg

Publicado 2001-05-30 · Atualizado 2018-05-03 · CVE-2001-0522

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GnuPG versions 1.0.5 and earlier GnuPG version 1.0.6

Description The issue is related to a format string vulnerability in GnuPG, which can be exploited to gain privileges. This can be achieved via format strings in the original filename stored in an encrypted file. The exploitation of this vulnerability can lead to a breach of confidentiality, integrity, and availability of protected information and can be performed remotely.

Recommendations For GnuPG versions 1.0.5 and earlier, update to a version later than 1.0.5 to resolve the issue. For GnuPG version 1.0.6, consider disabling the use of encrypted files with potentially malicious filenames until a patch is available.

Exploit

Correção

Identificadores relacionados

BDU:2015-07878

CVE-2001-0522

Produtos afetados

Gnupg

Referências · 18

• 🔥 https://exploit-db.com/exploits/20889 · Exploit
• http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-023-01 · Aviso do Fabricante
• http://securityfocus.com/bid/2797 · Nota
• http://linux-mandrake.com/en/security/2001/MDKSA-2001-053.php3 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-07878 · Nota de Segurança
• http://online.securityfocus.com/archive/1/188218 · Nota
• http://osvdb.org/1845 · Nota
• https://rhn.redhat.com/errata/RHSA-2001-073.html · Nota
• http://novell.com/linux/security/advisories/2001_020_gpg_txt.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6642 · Nota
• http://kb.cert.org/vuls/id/403051 · Nota
• http://calderasystems.com/support/security/advisories/CSSA-2001-020.0.txt · Aviso do Fabricante
• http://gnupg.org/whatsnew.html#rn20010529 · Nota
• http://redhat.com/support/errata/RHSA-2001-073.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-0522 · Nota de Segurança