Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2006:0266

The remote host is missing updates announced in
advisory RHSA-2006:0266.

GnuPG is a utility for encrypting data and creating digital signatures.

Tavis Ormandy discovered a bug in the way GnuPG verifies cryptographically
signed data with detached signatures. It is possible for an attacker to
construct a cryptographically signed message which could appear to come
from a third party. When a victim processes a GnuPG message with a
malformed detached signature, GnuPG ignores the malformed signature,
processes and outputs the signed data, and exits with status 0, just as it
would if the signature had been valid. In this case, GnuPG's exit status
would not indicate that no signature verification had taken place. This
issue would primarily be of concern when processing GnuPG results via an
automated script. The Common Vulnerabilities and Exposures project assigned
the name CVE-2006-0455 to this issue.

Tavis Ormandy also discovered a bug in the way GnuPG verifies
cryptographically signed data with inline signatures. It is possible for an
attacker to inject unsigned data into a signed message in such a way that
when a victim processes the message to recover the data, the unsigned data
is output along with the signed data, gaining the appearance of having been
signed. This issue is mitigated in the GnuPG shipped with Red Hat
Enterprise Linux as the --ignore-crc-error option must be passed to the gpg
executable for this attack to be successful. The Common Vulnerabilities and
Exposures project assigned the name CVE-2006-0049 to this issue.

Please note that neither of these issues affect the way RPM or up2date
verify RPM package files, nor is RPM vulnerable to either of these issues.

All users of GnuPG are advised to upgrade to this updated package, which
contains backported patches to correct these issues.

Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

Risk factor : Medium

CVSS Score:

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2006-0049
BugTraq ID: 17058
Bugtraq: 20060309 GnuPG does not detect injection of unsigned data (Google Search)
Debian Security Information: DSA-993 (Google Search)
SGI Security Advisory: 20060401-01-U
SuSE Security Announcement: SUSE-SA:2006:014 (Google Search)
XForce ISS Database: gnupg-nondetached-sig-verification(25184)
Common Vulnerability Exposure (CVE) ID: CVE-2006-0455
BugTraq ID: 16663
Bugtraq: 20060215 False positive signature verification in GnuPG (Google Search)
Debian Security Information: DSA-978 (Google Search)
SuSE Security Announcement: SUSE-SA:2006:009 (Google Search)
SuSE Security Announcement: SUSE-SA:2006:013 (Google Search)
SuSE Security Announcement: SUSE-SR:2006:005 (Google Search)
XForce ISS Database: gnupg-gpgv-improper-verification(24744)
CopyrightCopyright (c) 2006 E-Soft Inc.

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

© 1998-2021 E-Soft Inc. All rights reserved.