BugTraq
[ MDVSA-2013:247 ] gnupg Oct 10 2013 12:48PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:247
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : gnupg
Date : October 10, 2013
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in gnupg:

GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with
all bits cleared (no usage permitted) as if it has all bits set
(all usage permitted), which might allow remote attackers to bypass
intended cryptographic protection mechanisms by leveraging the subkey
(CVE-2013-4351).

Special crafted input data may be used to cause a denial of service
against GPG. GPG can be forced to recursively parse certain parts of
OpenPGP messages ad infinitum (CVE-2013-4402).

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4351
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4402
http://advisories.mageia.org/MGASA-2013-0299.html
http://advisories.mageia.org/MGASA-2013-0303.html
http://lists.gnu.org/archive/html/info-gnu/2013-10/msg00002.html
http://lists.gnu.org/archive/html/info-gnu/2013-10/msg00003.html
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
fbd115f23ec4f6a05582ae80e49e7645 mes5/i586/gnupg-1.4.9-5.3mdvmes5.2.i586.rpm
6acd4c8754851b6538b65b0e47b0b713 mes5/i586/gnupg2-2.0.9-3.3mdvmes5.2.i586.rpm
241f14f857ac10bcdb27d85dada891dd mes5/SRPMS/gnupg-1.4.9-5.3mdvmes5.2.src.rpm
57f10f15a3dabba96af7a0056536613b mes5/SRPMS/gnupg2-2.0.9-3.3mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
89b1885f005f3eaf6b0f9d11fb787554 mes5/x86_64/gnupg-1.4.9-5.3mdvmes5.2.x86_64.rpm
e8066bcd0cfcab70000adc18598854f9 mes5/x86_64/gnupg2-2.0.9-3.3mdvmes5.2.x86_64.rpm
241f14f857ac10bcdb27d85dada891dd mes5/SRPMS/gnupg-1.4.9-5.3mdvmes5.2.src.rpm
57f10f15a3dabba96af7a0056536613b mes5/SRPMS/gnupg2-2.0.9-3.3mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
284ac6d2ad095ce979df482fa99d210a mbs1/x86_64/gnupg-1.4.12-3.2.mbs1.x86_64.rpm
a118676f072c0a52988f2aeec6bf86af mbs1/x86_64/gnupg2-2.0.18-3.2.mbs1.x86_64.rpm
8e07611a9d7e2d7ab16d01a6a9d4090b mbs1/SRPMS/gnupg-1.4.12-3.2.mbs1.src.rpm
db92e694092193f98dc2fd43fe6c3912 mbs1/SRPMS/gnupg2-2.0.18-3.2.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSVnYCmqjQ0CJFipgRArb0AKDO1x51xpdkXHmgOiOxjw6ei5SLAACZAVJZ
Dry2GuDwPgRZX3xGrxTWbFU=
=s4km
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus