PT-2007-1068 · Gnu+1 · Gnupg+1

Gerardo Richarte · Published 2007-03-06 · Updated 2018-10-16 · CVE-2007-1263

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: GnuPG versions 1.0.7 through 1.2.6 GnuPG versions 1.4.6 and earlier

Description: The issue may lead to a breach of confidentiality, integrity, and availability of protected information. It can be exploited remotely. The problem is related to the visual distinction of signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.

Recommendations: For GnuPG versions 1.0.7 through 1.2.6, update to a version later than 1.2.6 to resolve the issue. For GnuPG versions 1.4.6 and earlier, update to a version later than 1.4.6 to resolve the issue. As a temporary workaround, consider visually verifying the authenticity of OpenPGP messages to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BDU:2015-07238

BDU:2015-07239

BDU:2015-07240

CVE-2007-1263

DSA-1266-1

RHSA-2007:0106

RHSA-2007:0107

RHSA-2007_0106

RHSA-2007_0107

Affected Products

Gnupg

Red Hat

References · 45

• 🔥 https://exploit-db.com/exploits/29689 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2007-1263 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0107.html · Vendor Advisory
• http://trustix.org/errata/2007/0009 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:059 · Vendor Advisory
• http://coresecurity.com/?action=item&id=1687 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0106.html · Vendor Advisory
• http://ubuntu.com/usn/usn-432-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07238 · Security Note
• http://fedoranews.org/cms/node/2775 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07239 · Security Note
• http://debian.org/security/2007/dsa-1266 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1263 · Vendor Advisory
• http://lists.suse.com/archive/suse-security-announce/2007-Mar/0008.html · Vendor Advisory