PT-2010-1015 · Gnu+1 · Gnupg+1

Peter Gutmann · Published 2010-08-04 · Updated 2024-06-15 · CVE-2010-2547

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GnuPG versions 2.x through 2.0.16

Description The issue is related to a use-after-free vulnerability in the kbx/keybox-blob.c file of GPGSM in GnuPG. This vulnerability can be exploited by remote attackers who send a certificate with a large number of Subject Alternate Names, which is not properly handled during a realloc operation when importing the certificate or verifying its signature. This can cause a denial of service (crash) and possibly allow the execution of arbitrary code. Additionally, there are multiple vulnerabilities in the gnupg-agent package that can lead to violations of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For GnuPG versions 2.x through 2.0.16, update to a version later than 2.0.16 to resolve the issue. As a temporary workaround, consider restricting the import of certificates with a large number of Subject Alternate Names to minimize the risk of exploitation.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2015-02575

CVE-2010-2547

DSA-2076-1

OPENSUSE-SU-2024:10102-1

RHSA-2010:0603

RHSA-2010_0603

Affected Products

Gnupg

Red Hat

References · 33

• http://lists.fedoraproject.org/pipermail/package-announce/2010-August/044935.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/1931 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.462008 · Vendor Advisory
• http://secunia.com/advisories/38877 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2547 · Vendor Advisory
• http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02575 · Security Note
• http://vupen.com/english/advisories/2010/1988 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2547 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2547 · Security Note
• http://secunia.com/advisories/40718 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-2547 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10102-1 · Vendor Advisory
• http://secunia.com/advisories/40841 · Vendor Advisory
• http://debian.org/security/2010/dsa-2076 · Vendor Advisory