PT-2006-1138 · Gnu+1 · Gnupg+1

Taviso · Published 2006-03-13 · Updated 2018-10-19 · CVE-2006-0049

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: GnuPG versions prior to 1.4.2.2

Description: The issue concerns the verification of non-detached signatures. Attackers can inject unsigned data via a data packet not associated with a control packet. This causes the check for concatenated signatures to incorrectly report the signature as valid.

Recommendations: For versions prior to 1.4.2.2, update to version 1.4.2.2 or later to resolve the issue.

Fix

Related Identifiers

CVE-2006-0049

DSA-993-2

RHSA-2006:0266

RHSA-2006_0266

Affected Products

Gnupg

Red Hat

References · 41

• http://securitytracker.com/id?1015749 · Patch
• ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U · Vendor Advisory
• http://redhat.com/archives/fedora-announce-list/2006-March/msg00021.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04150 · Security Note
• http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.476477 · Vendor Advisory
• http://securityfocus.com/bid/17058 · Patch
• http://secunia.com/advisories/19173 · Vendor Advisory
• http://osvdb.org/23790 · Patch
• http://lists.suse.de/archive/suse-security-announce/2006-Mar/0003.html · Vendor Advisory
• http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html · Vendor Advisory
• http://securityfocus.com/archive/1/433931/100/0/threaded · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04818 · Security Note
• https://usn.ubuntu.com/264-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04817 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:055 · Vendor Advisory