Debian Bug report logs -
#401894
gnupg: [CVE-2006-6235] remotely controllable function pointer
Reported by: Henrique de Moraes Holschuh <hmh@debian.org>
Date: Wed, 6 Dec 2006 17:33:01 UTC
Severity: grave
Tags: security, upstream
Merged with 401898,
401914
Found in versions gnupg/1.4.1-1, gnupg/1.4.5-3
Fixed in version 1.4.6-1
Done: Henrique de Moraes Holschuh <hmh@debian.org>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded to debian-bugs-dist@lists.debian.org, Debian Security Team <team@security.debian.org>, James Troup <james@nocrew.org>
:
Bug#401894
; Package gnupg
.
(full text, mbox, link).
Acknowledgement sent to Henrique de Moraes Holschuh <hmh@debian.org>
:
New Bug report received and forwarded. Copy sent to Debian Security Team <team@security.debian.org>, James Troup <james@nocrew.org>
.
(full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Package: gnupg
Version: 1.4.1-1
Severity: grave
Tags: security
Justification: user security hole
http://lwn.net/Articles/212909/
From: Werner Koch <wk-AT-g10code.com>
To: bugtraq-AT-securityfocus.com
Subject: GnuPG: remotely controllable function pointer [CVE-2006-6235]
Date: Wed, 06 Dec 2006 16:58:16 +0100
Cc: lwn-AT-lwn.net
GnuPG: remotely controllable function pointer [CVE-2006-6235]
===============================================================
2006-12-04
Summary
=======
Tavis Ormandy of the Gentoo security team identified a severe and
exploitable bug in the processing of encrypted packets in GnuPG.
[ Please do not send private mail in response to this message. The
mailing list gnupg-devel is the best place to discuss this problem
(please subscribe first so you don't need moderator approval [1]). ]
Impact
======
Using malformed OpenPGP packets an attacker is able to modify and
dereference a function pointer in GnuPG. This is a remotely
exploitable bug and affects any use of GnuPG where an attacker can
control the data processed by GnuPG. It is not necessary limited to
encrypted data, also signed data may be affected.
Affected versions: All versions of GnuPG < 1.4.6
All versions of GnuPG-2 < 2.0.2
All beta versions of GnuPG-2 (1.9.0 .. 1.9.95)
Affected tools: gpg, gpgv, gpg2 and gpgv2.
Affected platforms: All.
gpg-agent, gpgsm as well as other tools are not affected.
A workaround is not known.
Solution
========
If you are using a vendor supplied version of GnuPG:
* Wait for an update from your vendor. Vendors have been informed on
Saturday December 2, less than a day after this bug has been reported.
If you are using GnuPG 1.4:
* Update as soon as possible to GnuPG 1.4.6. It has been uploaded to
the usual location: ftp://ftp.gnupg.org/gcrypt/gnupg/. This version
was due to be released anyway this week. See
http://www.gnupg.org/download/ for details.
* Or: As another and less intrusive option, apply the attached patch
to GnuPG 1.4.5. This is the smallest possible fix.
If you are using GnuPG 2.0:
* Apply the attached patch against GnuPG 2.0.1.
* Or: Stop using gpg2 and gpgv2, install GnuPG 1.4.6 and use gpg and gpgv
instead.
If you are using a binary Windows version of GnuPG:
* A binary version of GnuPG 1.4.6 for Windows is available as usual.
* Gpg4win 1.0.8, including GnuPG 1.4.6, is available. Please go to
http://www.gpg4win.org .
Background
==========
GnuPG uses data structures called filters to process OpenPGP messages.
These filters ware used in a similar way as a pipelines in the shell.
For communication between these filters context structures are used.
These are usually allocated on the stack and passed to the filter
functions. At most places the OpenPGP data stream fed into these
filters is closed before the context structure gets deallocated.
While decrypting encrypted packets, this may not happen in all cases
and the filter may use a void contest structure filled with garbage.
An attacker may control this garbage. The filter context includes
another context used by the low-level decryption to access the
decryption algorithm. This is done using a function pointer. By
carefully crafting an OpenPGP message, an attacker may control this
function pointer and call an arbitrary function of the process.
Obviously an exploit needs to prepared for a specific version,
compiler, libc, etc to be successful - but it is definitely doable.
Fixing this is obvious: We need to allocate the context on the heap
and use a reference count to keep it valid as long as either the
controlling code or the filter code needs it.
We have checked all other usages of such a stack based filter contexts
but fortunately found no other vulnerable places. This allows to
release a relatively small patch. However, for reasons of code
cleanness and easier audits we will soon start to change all these
stack based filter contexts to heap based ones.
Support
=======
g10 Code GmbH, a Duesseldorf based company owned and headed by GnuPG's
principal author, is currently funding GnuPG development. As evident
by the two vulnerabilities found within a week, a review of the entire
code base should be undertaken as soon as possible. As maintainers we
try to do our best and are working slowly through the code. The long
standing plan is to scrutinize the 2.0 code base, write more test
cases and to backport new fixes and cleanups to 1.4. However, as a
small company our resources are limited and we need to prioritize
other projects which get us actual revenues. Support contracts or
other financial backing would greatly help us to improve the quality
of GnuPG.
Thanks
======
Tavis Ormandy found this vulnerability.
[1] See http://lists.gnupg.org/mailman/listinfo/gnupg-devel .
-- System Information:
Debian Release: 4.0
APT prefers unstable
APT policy: (990, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.16.32-debian13+bluesmoke+lm85
Locale: LANG=pt_BR.ISO-8859-1, LC_CTYPE=pt_BR.ISO-8859-1 (charmap=ISO-8859-1)
Versions of packages gnupg depends on:
ii gpgv 1.4.5-3 GNU privacy guard - signature veri
ii libbz2-1.0 1.0.3-6 high-quality block-sorting file co
ii libc6 2.3.6.ds1-8 GNU C Library: Shared libraries
ii libldap2 2.1.30-13.2 OpenLDAP libraries
ii libreadline5 5.2-1 GNU readline and history libraries
ii libusb-0.1-4 2:0.1.12-2 userspace USB programming library
ii makedev 2.3.1-83 creates device files in /dev
ii zlib1g 1:1.2.3-13 compression library - runtime
gnupg recommends no packages.
-- no debconf information
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Tags added: upstream
Request was from Florian Weimer <fw@deneb.enyo.de>
to control@bugs.debian.org
.
(full text, mbox, link).
Reply sent to Henrique de Moraes Holschuh <hmh@debian.org>
:
You have taken responsibility.
(full text, mbox, link).
Notification sent to Henrique de Moraes Holschuh <hmh@debian.org>
:
Bug acknowledged by developer.
(full text, mbox, link).
Message #16 received at 401894-done@bugs.debian.org (full text, mbox, reply):
Version: 1.4.6-1
This bug has been fixed by the following upload to unstable; it remains open
in stable:
gnupg (1.4.6-1) unstable; urgency=high
* New upstream release.
* Fixes remotely controllable function pointer [CVE-2006-6235]
* 27_filename_overflow.dpatch: merged upstream, dropped.
* 24_gpgv_manpage_cleanup.dpatch: updated and a couple of additional
trivial fixes.
* debian/rules (binary-arch): info copy of manuals moved to
/usr/share/info - remove them there instead. Manuals are now built
from texi source, so install them from build tree, not top level.
* debian/copyright: update to add OpenSSL exemption for keyserver helper
tools.
-- James Troup <james@nocrew.org> Thu, 7 Dec 2006 02:54:51 +0000
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Reply sent to Henrique de Moraes Holschuh <hmh@debian.org>
:
You have taken responsibility.
(full text, mbox, link).
Notification sent to Edward Guldemond <edward.guldemond@gmail.com>
:
Bug acknowledged by developer.
(full text, mbox, link).
Reply sent to Henrique de Moraes Holschuh <hmh@debian.org>
:
You have taken responsibility.
(full text, mbox, link).
Notification sent to Florian Weimer <fw@deneb.enyo.de>
:
Bug acknowledged by developer.
(full text, mbox, link).
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org
.
(Sun, 24 Jun 2007 16:36:58 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 18:30:44 2019;
Machine Name:
beach
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.