DSA-1266-1 gnupg -- several vulnerabilities

Debian Security Advisory

DSA-1266-1 gnupg -- several vulnerabilities

Date Reported:

13 Mar 2007

Affected Packages:

gnupg

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 413922, Bug 414170.
In Mitre's CVE dictionary: CVE-2007-1263.

More information:

Gerardo Richarte discovered that GnuPG, a free PGP replacement, provides insufficient user feedback if an OpenPGP message contains both unsigned and signed portions. Inserting text segments into an otherwise signed message could be exploited to forge the content of signed messages. This update prevents such attacks; the old behaviour can still be activated by passing the --allow-multiple-messages option.

For the stable distribution (sarge) these problems have been fixed in version 1.4.1-1.sarge7.

For the upcoming stable distribution (etch) these problems have been fixed in version 1.4.6-2.

For the unstable distribution (sid) these problems have been fixed in version 1.4.6-2.

We recommend that you upgrade your gnupg packages.

Fixed in:

Debian GNU/Linux 3.1 (sarge)

Source:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7.dsc

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7.diff.gz

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1.orig.tar.gz

Alpha:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_amd64.deb

ARM:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_arm.deb

HPPA:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_hppa.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_ia64.deb

Motorola 680x0:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_m68k.deb

Big endian MIPS:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_mips.deb

Little endian MIPS:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_sparc.deb

MD5 checksums of the listed files are available in the original advisory.