PT-2006-1138 · Gnu+1 · Gnupg+1

Taviso · Publicado 2006-03-13 · Atualizado 2018-10-19 · CVE-2006-0049

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: GnuPG versions prior to 1.4.2.2

Description: The issue concerns the verification of non-detached signatures. Attackers can inject unsigned data via a data packet not associated with a control packet. This causes the check for concatenated signatures to incorrectly report the signature as valid.

Recommendations: For versions prior to 1.4.2.2, update to version 1.4.2.2 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2006-0049

DSA-993-2

RHSA-2006:0266

RHSA-2006_0266

Produtos afetados

Gnupg

Red Hat

Referências · 41

• http://securitytracker.com/id?1015749 · Correção
• http://securityreason.com/securityalert/568 · Nota
• https://access.redhat.com/errata/RHSA-2006:0266 · Nota
• ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U · Aviso do Fabricante
• http://secunia.com/advisories/19232 · Nota
• http://redhat.com/archives/fedora-announce-list/2006-March/msg00021.html · Aviso do Fabricante
• http://securityfocus.com/archive/1/427324/100/0/threaded · Nota
• https://bdu.fstec.ru/vul/2015-04150 · Nota de Segurança
• http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.476477 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10063 · Nota
• http://securityfocus.com/bid/17058 · Correção
• http://secunia.com/advisories/19173 · Aviso do Fabricante
• http://secunia.com/advisories/19234 · Nota
• http://osvdb.org/23790 · Correção
• http://lists.suse.de/archive/suse-security-announce/2006-Mar/0003.html · Aviso do Fabricante