• info
• discussion
• exploit
• solution
• references

GnuPG Signed Message Arbitrary Content Injection Weakness

Solution:
The vendor has released patches to address this issue. Contact the vendor for details on obtaining and applying the appropriate updates.


GNU GNU Privacy Guard 1.0

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.0 .6

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.0.1

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.0.2

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.0.3

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.0.4

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU finger 1.0.7

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.0.7

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.1

• Ubuntu libgpgme11-dev_1.1.0-1ubuntu0.1_amd64.deb
  Ubuntu 6.06 LTS:
  http://security.ubuntu.com/ubuntu/pool/main/g/gpgme1.0/libgpgme11-dev_ 1.1.0-1ubuntu0.1_amd64.deb


• Ubuntu libgpgme11-dev_1.1.0-1ubuntu0.1_i386.deb
  Ubuntu 6.06 LTS:
  http://security.ubuntu.com/ubuntu/pool/main/g/gpgme1.0/libgpgme11-dev_ 1.1.0-1ubuntu0.1_i386.deb


• Ubuntu libgpgme11-dev_1.1.0-1ubuntu0.1_powerpc.deb
  Ubuntu 6.06 LTS:
  http://security.ubuntu.com/ubuntu/pool/main/g/gpgme1.0/libgpgme11-dev_ 1.1.0-1ubuntu0.1_powerpc.deb


• Ubuntu libgpgme11-dev_1.1.0-1ubuntu0.1_sparc.deb
  Ubuntu 6.06 LTS:
  http://security.ubuntu.com/ubuntu/pool/main/g/gpgme1.0/libgpgme11-dev_ 1.1.0-1ubuntu0.1_sparc.deb


• Ubuntu libgpgme11_1.1.0-1ubuntu0.1_amd64.deb
  Ubuntu 6.06 LTS:
  http://security.ubuntu.com/ubuntu/pool/main/g/gpgme1.0/libgpgme11_1.1. 0-1ubuntu0.1_amd64.deb


• Ubuntu libgpgme11_1.1.0-1ubuntu0.1_i386.deb
  Ubuntu 6.06 LTS:
  http://security.ubuntu.com/ubuntu/pool/main/g/gpgme1.0/libgpgme11_1.1. 0-1ubuntu0.1_i386.deb


• Ubuntu libgpgme11_1.1.0-1ubuntu0.1_powerpc.deb
  Ubuntu 6.06 LTS:
  http://security.ubuntu.com/ubuntu/pool/main/g/gpgme1.0/libgpgme11_1.1. 0-1ubuntu0.1_powerpc.deb


• Ubuntu libgpgme11_1.1.0-1ubuntu0.1_sparc.deb
  Ubuntu 6.06 LTS:
  http://security.ubuntu.com/ubuntu/pool/main/g/gpgme1.0/libgpgme11_1.1. 0-1ubuntu0.1_sparc.deb

GNU GNU Privacy Guard 1.2.1

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.2.2 -rc1

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.2.2 -r1

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.2.3

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.2.4

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.2.6

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.3.4

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.4

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2


• SuSE gpg-1.4.0-4.14.i586.rpm
  SUSE LINUX 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gpg-1.4.0-4.14.i5 86.rpm


• SuSE gpg-1.4.0-4.14.x86_64.rpm
  SUSE LINUX 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/gpg-1.4.0-4.14. x86_64.rpm

GNU GNU Privacy Guard 1.4.1

• Debian gnupg_1.4.1-1.sarge7_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_alpha.deb


• Debian gnupg_1.4.1-1.sarge7_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_amd64.deb


• Debian gnupg_1.4.1-1.sarge7_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_arm.deb


• Debian gnupg_1.4.1-1.sarge7_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_hppa.deb


• Debian gnupg_1.4.1-1.sarge7_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_i386.deb


• Debian gnupg_1.4.1-1.sarge7_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_ia64.deb


• Debian gnupg_1.4.1-1.sarge7_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_m68k.deb


• Debian gnupg_1.4.1-1.sarge7_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_mips.deb


• Debian gnupg_1.4.1-1.sarge7_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_mipsel.deb


• Debian gnupg_1.4.1-1.sarge7_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_powerpc.deb


• Debian gnupg_1.4.1-1.sarge7_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_s390.deb


• Debian gnupg_1.4.1-1.sarge7_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1.sar ge7_sparc.deb


• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.4.2 .1

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.4.3

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.4.4

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2

GNU GNU Privacy Guard 1.4.5

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2


• SuSE gpg-1.4.5-24.4.i586.rpm
  openSUSE 10.2:
  ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/gpg-1.4.5-24.4.i586.r pm


• SuSE gpg-1.4.5-24.4.ppc.rpm
  openSUSE 10.2:
  ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/gpg-1.4.5-24.4.ppc.rpm


• SuSE gpg-1.4.5-24.4.x86_64.rpm
  openSUSE 10.2:
  ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/gpg-1.4.5-24.4.x86_ 64.rpm

GNU GNU Privacy Guard 1.4.6

• GNU gnupg-1.4.7.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.7.tar.bz2