Published: 15/02/2006 Updated: 07/11/2023

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

VMScore: 465

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

gpgv in GnuPG prior to 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu privacy guard 1.4.2
gnu privacy guard 1.4
gnu privacy guard 1.4.1
gnu privacy guard 1.0.3
gnu privacy guard 1.2.1
gnu privacy guard 1.0.7
gnu privacy guard 1.0.5
gnu privacy guard 1.0.6
gnu privacy guard 1.3.3
gnu privacy guard 1.2.2
gnu privacy guard 1.0
gnu privacy guard 1.0.2
gnu privacy guard 1.2.3
gnu privacy guard 1.2.6
gnu privacy guard 1.2.5
gnu privacy guard 1.0.4
gnu privacy guard 1.3.4
gnu privacy guard 1.0.1
gnu privacy guard 1.0.3b
gnu privacy guard 1.2
gnu privacy guard 1.2.7
gnu privacy guard 1.2.4

Debian Bug report logs - #353017 gnupg: False positive signature verification in GnuPG Package: gnupg; Maintainer for gnupg is Debian GnuPG Maintainers <pkg-gnupg-maint@listsaliothdebianorg>; Source for gnupg is src:gnupg2 (PTS, buildd, popcon) Reported by: Micah Anderson <micah@debianorg> Date: Wed, 15 Feb 2006 ...

Tavis Ormandy discovered a potential weakness in the signature verification of gnupg gpgv and gpg –verify returned a successful exit code even if the checked file did not have any signature at all The recommended way of checking the result is to evaluate the status messages, but some third party applications might just check the exit code for d ...

Tavis Ormandy noticed that gnupg, the GNU privacy guard - a free PGP replacement, verifies external signatures of files successfully even though they don't contain a signature at all For the old stable distribution (woody) this problem has been fixed in version 106-4woody4 For the stable distribution (sarge) this problem has been fixed in versi ...

source: wwwsecurityfocuscom/bid/16663/info GnuPG is affected by a detached signature verification-bypass vulnerability because it fails to properly notify scripts that an invalid detached signature was presented and that the verification process has failed Exploiting this issue allows attackers to bypass the signature-verification proce ...

CVE-2006-0455

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect