PT-2003-1084 · Red Hat+1 · Red Hat+1

David Shaw · Published 2003-05-07 · Updated 2018-05-03 · CVE-2003-0255

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GnuPG versions prior to 1.2.2 Red Hat Linux (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the GnuPG package that can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The key validation code in GnuPG does not properly determine the validity of keys with multiple user IDs, assigning the greatest validity of the most valid user ID. This prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.

Recommendations For GnuPG versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. For Red Hat Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-08014

CVE-2003-0255

Affected Products

Gnupg

Red Hat

References · 19

• http://turbolinux.com/security/TLSA-2003-34.txt · Vendor Advisory
• http://marc.info/?l=bugtraq&m=105301357425157&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0255 · Security Note
• http://linuxsecurity.com/advisories/engarde_advisory-3258.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2003:061 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-176.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-175.html · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000694 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08014 · Security Note
• http://marc.info/?l=bugtraq&m=105362224514081&w=2 · Note
• http://kb.cert.org/vuls/id/397604 · Note
• http://securityfocus.com/bid/7497 · Note
• http://linuxsecurity.com/advisories/gentoo_advisory-3266.html · Note
• http://marc.info/?l=bugtraq&m=105215110111174&w=2 · Note
• http://osvdb.org/4947 · Note