PT-2013-2032 · Gnu+1 · Gnupg+1

Publicado 2013-07-24 · Atualizado 2013-07-24 · CVE-2012-6578

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions 3.8.x through 3.8.14 Best Practical Solutions RT versions 4.0.x through 4.0.7

Description The issue occurs when GnuPG is enabled with a "Sign by default" queue configuration, allowing the use of a queue's key for signing. This might enable remote attackers to spoof messages by exploiting the lack of authentication semantics.

Recommendations For versions 3.8.x through 3.8.14, update to version 3.8.15 or later. For versions 4.0.x through 4.0.7, update to version 4.0.8 or later.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-6578

DSA-2567-1

Produtos afetados

Gnupg

Rt

Referências · 10

• https://cve.org/CVERecord?id=CVE-2012-6578 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6578 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-6578 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-6578 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=870406#c3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6578 · Nota de Segurança
• https://ubuntu.com/security/CVE-2012-6578 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-6578 · Aviso do Fabricante
• http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-6578 · Aviso do Fabricante