• info
• discussion
• exploit
• solution
• references

GnuPG Format String Vulnerability

Solution:
A new version of GnuPG is available which addresses these issues:


GNU GNU Privacy Guard 1.0.4

• Caldera OpenLinux 3.1 Server i386 gnupg-1.0.6-1.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS/gn upg-1.0.6-1.i386.rpm


• Caldera OpenLinux 3.1 Workstation i386 gnupg-1.0.6-1.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RP MS/gnupg-1.0.6-1.i386.rpm


• Conectiva 4.0 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0/i386/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 4.0 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0/i386/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva 4.0es i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0es/i386/gnupg-1.0.6-1cl.i386.rp m


• Conectiva 4.0es i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0es/i386/gnupg-doc-1.0.6-1cl.i38 6.rpm


• Conectiva 4.1 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.1/i386/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 4.1 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.1/i386/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva 4.2 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.2/i386/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 4.2 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.2/i386/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva 5.0 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 5.0 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva 5.1 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 5.1 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva 6.0 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 6.0 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva ecommerce i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/gnupg-1 .0.6-1cl.i386.rpm


• Conectiva ecommerce i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/gnupg-d oc-1.0.6-1cl.i386.rpm


• Conectiva graficas i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/gnupg-1. 0.6-1cl.i386.rpm


• Conectiva graficas i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/gnupg-do c-1.0.6-1cl.i386.rpm


• RedHat 7.1 i386 gnupg-1.0.6-1.i386.rpm
  ftp://updates.redhat.com/7.1/en/os/i386/gnupg-1.0.6-1.i386.rpm


• TurboLinux 6.0 i386 gnupg-1.0.6-1.i386.rpm
  ftp://ftp.turbolinux.com/pub/updates/6.0/security/gnupg-1.0.6-1.i386.r pm

GNU GNU Privacy Guard 1.0.5

• Caldera eDesktop 2.4 i386 gnupg-1.0.6-1.i386.rpm
  ftp://ftp.caldera.com/pub/updates/eDesktop/2.4/current/RPMS/gnupg-1.0. 6-1.i386.rpm


• Caldera OpenLinux 2.3 gnupg-1.0.6-1.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/2.3/current/RPMS/gnupg-1.0 .6-1.i386.rpm


• Conectiva 4.0 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0/i386/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 4.0 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0/i386/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva 4.0es i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0es/i386/gnupg-1.0.6-1cl.i386.rp m


• Conectiva 4.0es i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0es/i386/gnupg-doc-1.0.6-1cl.i38 6.rpm


• Conectiva 4.1 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.1/i386/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 4.1 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.1/i386/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva 4.2 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.2/i386/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 4.2 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.2/i386/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva 5.0 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 5.0 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva 5.1 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 5.1 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva 6.0 i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/gnupg-1.0.6-1cl.i386.rpm


• Conectiva 6.0 i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/gnupg-doc-1.0.6-1cl.i386. rpm


• Conectiva ecommerce i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/gnupg-1 .0.6-1cl.i386.rpm


• Conectiva ecommerce i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/gnupg-d oc-1.0.6-1cl.i386.rpm


• Conectiva graficas i386 gnupg-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/gnupg-1. 0.6-1cl.i386.rpm


• Conectiva graficas i386 gnupg-doc-1.0.6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/gnupg-do c-1.0.6-1cl.i386.rpm


• Debian 2.2 alpha gnupg_1.0.6-0potato1_alpha.deb
  http://security.debian.org/dists/stable/updates/main/binary-alpha/gnup g_1.0.6-0potato1_alpha.deb


• Debian 2.2 arm gnupg_1.0.6-0potato1_arm.deb
  http://security.debian.org/dists/stable/updates/main/binary-arm/gnupg_ 1.0.6-0potato1_arm.deb


• Debian 2.2 i386 gnupg_1.0.6-0potato1_i386.deb
  http://security.debian.org/dists/stable/updates/main/binary-i386/gnupg _1.0.6-0potato1_i386.deb


• Debian 2.2 m68k gnupg_1.0.6-0potato1_m68k.deb
  http://security.debian.org/dists/stable/updates/main/binary-m68k/gnupg _1.0.6-0potato1_m68k.deb


• Debian 2.2 ppc gnupg_1.0.6-0potato1_powerpc.deb
  http://security.debian.org/dists/stable/updates/main/binary-powerpc/gn upg_1.0.6-0potato1_powerpc.deb


• Debian 2.2 sparc gnupg_1.0.6-0potato1_sparc.deb
  http://security.debian.org/dists/stable/updates/main/binary-sparc/gnup g_1.0.6-0potato1_sparc.deb


• Gnu GNU Privacy Guard 1.0.6
  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.0.6.tar.gz


• Immunix 6.2 i386 gnupg-1.0.6-2_StackGuard.i386.rpm
  http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/gnupg-1.0.6-2_S tackGuard.i386.rpm


• Immunix 7.0 i386 gnupg-1.0.6-2_imnx.i386.rpm
  http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/gnupg-1.0.6-2_i mnx.i386.rpm


• Mandrake 8.0 ppc gnupg-1.0.6-2.1mdk.ppc.rpm
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake 8.1 i586 gnupg-1.0.6-3.1mdk.i586.rpm
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake 1.0.1 i586 gnupg-1.0.6-1.2mdk.i586.rpm
  ftp://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/1.0.1/RPMS /gnupg-1.0.6-1.2mdk.i586.rpm


• Mandrake 7.1 i586 gnupg-1.0.6-1.2mdk.i586.rpm
  ftp://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/7.1/RPMS/g nupg-1.0.6-1.2mdk.i586.rpm


• Mandrake 7.2 i586 gnupg-1.0.6-1.1mdk.i586.rpm
  ftp://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/7.2/RPMS/g nupg-1.0.6-1.1mdk.i586.rpm


• Mandrake 8.0 i586 gnupg-1.0.6-1.1mdk.i586.rpm
  ftp://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/8.0/RPMS/g nupg-1.0.6-1.1mdk.i586.rpm


• RedHat 6.2 alpha gnupg-1.0.6-0.6.x.alpha.rpm
  ftp://updates.redhat.com/6.2/en/os/alpha/gnupg-1.0.6-0.6.x.alpha.rpm


• RedHat 6.2 i386 gnupg-1.0.6-0.6.x.i386.rpm
  ftp://updates.redhat.com/6.2/en/os/i386/gnupg-1.0.6-0.6.x.i386.rpm


• RedHat 6.2 sparc gnupg-1.0.6-0.6.x.sparc.rpm
  ftp://updates.redhat.com/6.2/en/os/sparc/gnupg-1.0.6-0.6.x.sparc.rpm


• RedHat 7.0 alpha gnupg-1.0.6-1.alpha.rpm
  ftp://updates.redhat.com/7.0/en/os/alpha/gnupg-1.0.6-1.alpha.rpm


• RedHat 7.0 i386 gnupg-1.0.6-1.i386.rpm
  ftp://updates.redhat.com/7.0/en/os/i386/gnupg-1.0.6-1.i386.rpm


• RedHat 7.1 i386 gnupg-1.0.6-1.i386.rpm
  ftp://updates.redhat.com/7.1/en/os/i386/gnupg-1.0.6-1.i386.rpm


• S.u.S.E. 6.3 alpha gpg-1.0.6-2.alpha.rpm
  ftp://ftp.suse.de/pub/suse/axp/update/6.3/sec1/gpg-1.0.6-2.alpha.rpm


• S.u.S.E. 6.3 i386 gpg-1.0.6-1.i386.rpm
  ftp://ftp.suse.de/pub/suse/i386/update/6.3/sec1/gpg-1.0.6-1.i386.rpm


• S.u.S.E. 6.4 alpha gpg-1.0.6-1.alpha.rpm
  ftp://ftp.suse.de/pub/suse/axp/update/6.4/sec1/gpg-1.0.6-1.alpha.rpm


• S.u.S.E. 6.4 i386 gpg-1.0.6-1.i386.rpm
  ftp://ftp.suse.de/pub/suse/i386/update/6.4/sec1/gpg-1.0.6-1.i386.rpm


• S.u.S.E. 7.0 alpha gpg-1.0.6-0.alpha.rpm
  ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/gpg-1.0.6-0.alpha.rpm


• S.u.S.E. 7.0 i386 gpg-1.0.6-0.i386.rpm
  ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/gpg-1.0.6-0.i386.rpm


• S.u.S.E. 7.0 ppc gpg-1.0.6-0.ppc.rpm
  ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/gpg-1.0.6-0.ppc.rpm


• S.u.S.E. 7.0 sparc gpg-1.0.6-0.sparc.rpm
  ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/gpg-1.0.6-0.sparc.rpm


• S.u.S.E. 7.1 i386 gpg-1.0.6-0.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/7.1/sec1/gpg-1.0.6-0.i386.rpm


• S.u.S.E. 7.1 ppc gpg-1.0.6-0.ppc.rpm
  ftp://ftp.suse.com/pub/suse/ppc/update/7.1/sec1/gpg-1.0.6-0.ppc.rpm


• S.u.S.E. 7.1 sparc gpg-1.0.6-0.sparc.rpm
  ftp://ftp.suse.com/pub/suse/sparc/update/7.1/sec1/gpg-1.0.6-0.sparc.rp m


• Trustix 1.1 i386 gnupg-1.0.6-1tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/gnupg-1.0.6-1tr.i58 6.rpm


• Trustix 1.2 i386 gnupg-1.0.6-1tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/gnupg-1.0.6-1tr.i58 6.rpm