Debian Security Advisory
DSA-1266-1 gnupg -- several vulnerabilities
- Date Reported:
- 13 Mar 2007
- Affected Packages:
- gnupg
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 413922, Bug 414170.
In Mitre's CVE dictionary: CVE-2007-1263. - More information:
-
Gerardo Richarte discovered that GnuPG, a free PGP replacement, provides insufficient user feedback if an OpenPGP message contains both unsigned and signed portions. Inserting text segments into an otherwise signed message could be exploited to forge the content of signed messages. This update prevents such attacks; the old behaviour can still be activated by passing the --allow-multiple-messages option.
For the stable distribution (sarge) these problems have been fixed in version 1.4.1-1.sarge7.
For the upcoming stable distribution (etch) these problems have been fixed in version 1.4.6-2.
For the unstable distribution (sid) these problems have been fixed in version 1.4.6-2.
We recommend that you upgrade your gnupg packages.
- Fixed in:
-
Debian GNU/Linux 3.1 (sarge)
- Source:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7.dsc
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7.diff.gz
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1.orig.tar.gz
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7.diff.gz
- Alpha:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_alpha.deb
- AMD64:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_amd64.deb
- ARM:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_arm.deb
- HPPA:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_hppa.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_ia64.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sarge7_sparc.deb
MD5 checksums of the listed files are available in the original advisory.