GnuPG 1.4 and 2.0 buffer overflow

Debian Bug report logs - #400777
GnuPG 1.4 and 2.0 buffer overflow

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: GnuPG 1.4 and 2.0 buffer overflow

Date: Tue, 28 Nov 2006 18:17:28 +0100

Package: gnupg2
Version: 2.0.0-5
Severity: grave
Tags: security
Justification: user security hole



A vulnerability has been reported in GnuPG 2. See 

http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html

for details.

Message #10 received at 400777@bugs.debian.org (full text, mbox, reply):

From: Neil McGovern <neilm@debian.org>

To: 400777@bugs.debian.org

Subject: CVE ID

Date: Thu, 30 Nov 2006 11:59:12 +0000

[Message part 1 (text/plain, inline)]

Hi there,

This has been assigned CVE-2006-6169

Please mention this id in the changelog when closing it.

Many thanks,
Neil McGovern
-- 
<hermanr> 10 people enough for a Debconf?  If they were all Germans, maybe...

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 400777@bugs.debian.org (full text, mbox, reply):

From: Andreas Barth <aba@not.so.argh.org>

To: 400777@bugs.debian.org

Subject: NMU uploaded

Date: Mon, 4 Dec 2006 19:48:08 +0100

Hi,

I uploaded an NMU of your package.

Please see this as help to get the package into a releaseable condition for
etch.

Please find the used diff below.


Cheers,
Andi

diff -ur ../gnupg2-2.0.0~/debian/changelog ../gnupg2-2.0.0/debian/changelog
--- ../gnupg2-2.0.0~/debian/changelog	2006-12-04 18:41:42.000000000 +0000
+++ ../gnupg2-2.0.0/debian/changelog	2006-12-04 18:42:48.000000000 +0000
@@ -1,3 +1,10 @@
+gnupg2 (2.0.0-5.1) unstable; urgency=high
+
+  * Non-maintainer upload.
+  * Fix buffer overflow, CVE-2006-6169. Closes: #400777
+
+ -- Andreas Barth <aba@not.so.argh.org>  Mon,  4 Dec 2006 18:42:06 +0000
+
 gnupg2 (2.0.0-5) unstable; urgency=high
 
   * debian/control: Remove unnecessary dependencies on makedev and
diff -ur ../gnupg2-2.0.0~/g10/openfile.c ../gnupg2-2.0.0/g10/openfile.c
--- ../gnupg2-2.0.0~/g10/openfile.c	2006-09-14 14:18:39.000000000 +0000
+++ ../gnupg2-2.0.0/g10/openfile.c	2006-12-04 18:43:28.000000000 +0000
@@ -145,8 +145,8 @@
 
     s = _("Enter new filename");
 
-    n = strlen(s) + namelen + 10;
     defname = name && namelen? make_printable_string( name, namelen, 0): NULL;
+    n = strlen(s) + (defname?strlen (defname):0) + 10;
     prompt = xmalloc(n);
     if( defname )
 	sprintf(prompt, "%s [%s]: ", s, defname );
-- 
  http://home.arcor.de/andreas-barth/

Message #20 received at 400777-close@bugs.debian.org (full text, mbox, reply):

From: Andreas Barth <aba@not.so.argh.org>

To: 400777-close@bugs.debian.org

Subject: Bug#400777: fixed in gnupg2 2.0.0-5.1

Date: Mon, 04 Dec 2006 19:02:21 +0000

Source: gnupg2
Source-Version: 2.0.0-5.1

We believe that the bug you reported is fixed in the latest version of
gnupg2, which is due to be installed in the Debian FTP archive:

gnupg-agent_2.0.0-5.1_amd64.deb
  to pool/main/g/gnupg2/gnupg-agent_2.0.0-5.1_amd64.deb
gnupg2_2.0.0-5.1.diff.gz
  to pool/main/g/gnupg2/gnupg2_2.0.0-5.1.diff.gz
gnupg2_2.0.0-5.1.dsc
  to pool/main/g/gnupg2/gnupg2_2.0.0-5.1.dsc
gnupg2_2.0.0-5.1_amd64.deb
  to pool/main/g/gnupg2/gnupg2_2.0.0-5.1_amd64.deb
gpgsm_2.0.0-5.1_amd64.deb
  to pool/main/g/gnupg2/gpgsm_2.0.0-5.1_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 400777@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Barth <aba@not.so.argh.org> (supplier of updated gnupg2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon,  4 Dec 2006 18:42:06 +0000
Source: gnupg2
Binary: gnupg2 gpgsm gnupg-agent
Architecture: source amd64
Version: 2.0.0-5.1
Distribution: unstable
Urgency: high
Maintainer: Eric Dorland <eric@debian.org>
Changed-By: Andreas Barth <aba@not.so.argh.org>
Description: 
 gnupg-agent - GNU privacy guard - password agent
 gnupg2     - GNU privacy guard - a free PGP replacement
 gpgsm      - GNU privacy guard - S/MIME version
Closes: 400777
Changes: 
 gnupg2 (2.0.0-5.1) unstable; urgency=high
 .
   * Non-maintainer upload.
   * Fix buffer overflow, CVE-2006-6169. Closes: #400777
Files: 
 06d07948924a9e3a1601c5a70432420d 859 utils optional gnupg2_2.0.0-5.1.dsc
 e0c258dc2682ad44b6cd9d97853357e4 194652 utils optional gnupg2_2.0.0-5.1.diff.gz
 39226aa4e18bf9f8bacaf8bbff9bd271 216768 utils optional gnupg-agent_2.0.0-5.1_amd64.deb
 a4462d7d28076bcee24d1fd8654ebf93 364712 utils optional gpgsm_2.0.0-5.1_amd64.deb
 0663feede4d84848d3b19b58a3e68192 1031218 utils extra gnupg2_2.0.0-5.1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFFdG08mdOZoew2oYURAkY0AJwKiyBM5/y4EyIJmWOA5OQ9g6QN4gCgqvTR
1Z0vlf72iKH6k6rt30r3tK8=
=zNzs
-----END PGP SIGNATURE-----

Message #25 received at 400777-close@bugs.debian.org (full text, mbox, reply):

From: Eric Dorland <eric@debian.org>

To: 400777-close@bugs.debian.org

Subject: Bug#400777: fixed in gnupg2 2.0.2-1

Date: Tue, 20 Feb 2007 01:47:03 +0000

Source: gnupg2
Source-Version: 2.0.2-1

We believe that the bug you reported is fixed in the latest version of
gnupg2, which is due to be installed in the Debian FTP archive:

gnupg-agent_2.0.2-1_i386.deb
  to pool/main/g/gnupg2/gnupg-agent_2.0.2-1_i386.deb
gnupg2_2.0.2-1.diff.gz
  to pool/main/g/gnupg2/gnupg2_2.0.2-1.diff.gz
gnupg2_2.0.2-1.dsc
  to pool/main/g/gnupg2/gnupg2_2.0.2-1.dsc
gnupg2_2.0.2-1_i386.deb
  to pool/main/g/gnupg2/gnupg2_2.0.2-1_i386.deb
gnupg2_2.0.2.orig.tar.gz
  to pool/main/g/gnupg2/gnupg2_2.0.2.orig.tar.gz
gpgsm_2.0.2-1_i386.deb
  to pool/main/g/gnupg2/gpgsm_2.0.2-1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 400777@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Eric Dorland <eric@debian.org> (supplier of updated gnupg2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 19 Feb 2007 20:34:52 -0500
Source: gnupg2
Binary: gnupg2 gpgsm gnupg-agent
Architecture: source i386
Version: 2.0.2-1
Distribution: unstable
Urgency: high
Maintainer: Eric Dorland <eric@debian.org>
Changed-By: Eric Dorland <eric@debian.org>
Description: 
 gnupg-agent - GNU privacy guard - password agent
 gnupg2     - GNU privacy guard - a free PGP replacement
 gpgsm      - GNU privacy guard - S/MIME version
Closes: 400777 401895 401913 409559
Changes: 
 gnupg2 (2.0.2-1) unstable; urgency=high
 .
   * New upstream release. (Closes: #409559)
   * Thanks Andreas Barth for NMUs. (Closes: #400777, #401895, #401913)
   * debian/gpgsm.install: pcsc-wrapper renamed to gnupg-pcsc-wrapper.
Files: 
 8dc89e59c887eca0f60451d3322533e2 854 utils optional gnupg2_2.0.2-1.dsc
 228841783d8923857a08938488449025 5418412 utils optional gnupg2_2.0.2.orig.tar.gz
 5c3075707132afc8ec5cd123cee229cc 41293 utils optional gnupg2_2.0.2-1.diff.gz
 3da49c109bf12e0b4aeb00b8898bd809 206342 utils optional gnupg-agent_2.0.2-1_i386.deb
 31360a8f04e149a9f40dcb50468b437c 341710 utils optional gpgsm_2.0.2-1_i386.deb
 3dccdc07b279a2c41111d03431be1838 992744 utils extra gnupg2_2.0.2-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFF2lJYYemOzxbZcMYRAsCHAKCuKy584lE+Mjjt/28y2R5zV3XFEwCeP+uZ
vPsYRHDfue5KTeuUwtsweI4=
=SLli
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.