PT-2006-7570 · Gnu+1 · Gnupg+1

Werner Koch · Published 1970-01-01 · Updated 2024-06-15 · CVE-2006-6169

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GnuPG versions 1.4 and 2.0

Description The issue is related to multiple vulnerabilities in the GnuPG package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, a heap-based buffer overflow in the ask outfile name function in openfile.c for GnuPG, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions.

Recommendations For GnuPG versions 1.4 and 2.0, consider disabling the ask outfile name function in openfile.c to minimize the risk of exploitation until a patch is available. Restrict access to the make printable string function to prevent attackers from executing arbitrary code.

Fix

Related Identifiers

BDU:2015-04219

BDU:2015-04952

BDU:2015-04953

CVE-2006-6169

DSA-1231-1

OPENSUSE-SU-2024:10815-1

RHSA-2006:0754

RHSA-2006_0754

Affected Products

Gnupg

Red Hat

References · 54

• http://openpkg.com/security/advisories/OpenPKG-SA-2006.037.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04953 · Security Note
• http://ubuntu.com/usn/usn-389-1 · Vendor Advisory
• http://trustix.org/errata/2006/0068 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6169 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-6169 · Vendor Advisory
• http://secunia.com/advisories/23094 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:221 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200612-03.xml · Vendor Advisory
• http://debian.org/security/2006/dsa-1231 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc · Vendor Advisory
• http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html · Vendor Advisory
• http://ubuntu.com/usn/usn-393-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6169 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10815-1 · Vendor Advisory