Red Hat セキュリティアドバイザリ 2006:0754 から：

2 つのセキュリティ問題を修正する更新済みの GnuPG パッケージが、現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新に重大なセキュリティインパクトがあると評価しています。

GnuPG は、データを暗号化し、デジタル署名を作成するためのユーティリティです。

Tavis Ormandy 氏は、GnuPG がメッセージを復号化する方法にスタックの上書きの欠陥があることを発見しました。攻撃者が、注意深く細工されたメッセージを作成し、被害者がメッセージを復号化しようとした場合に GnuPG に任意のコードを実行させる可能性があります。(CVE-2006-6235)

GnuPG が対話型セッション中にターミナルに書き込まれるメッセージを構築する方法に、ヒープベースのバッファオーバーフローの欠陥が見つかりました。攻撃者が、注意深く細工されたメッセージを作成し、ユーザーインタラクションで、GnuPG を実行しているユーザーの権限で GnuPG に任意のコードを実行させる可能性があります。
(CVE-2006-6169)

GnuPG の全ユーザーは、バックポートされたパッチが含まれるこの更新済みパッケージにアップグレードし、これらの問題を修正することが推奨されます。

New gnupg packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix security issues.

來自 Red Hat 安全性公告 2006:0754：

現已提供更新版 GnuPG 套件，其可修正兩個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有重要安全性影響。

GnuPG 是一套用於加密資料和建立數位簽章的公用程式。

Tavis Ormandy 在 GnuPG 解密訊息的方式中發現一個堆疊覆寫瑕疵。攻擊者可建立特製的訊息，如果受害者嘗試解密該訊息，其可造成 GnuPG 執行任意程式碼。(CVE-2006-6235)

在 GnuPG 於互動工作階段期間建構要寫入終端機的訊息之方式中，發現一個堆積型緩衝區溢位瑕疵。攻擊者可建立特製的訊息，透過使用者互動，該訊息可造成 GnuPG 以執行 GnuPG 的使用者權限執行任意程式碼。
(CVE-2006-6169)

建議所有 GnuPG 使用者皆升級至此更新版套件，其中包含可更正這些問題的反向移植修補程式。

来自 Red Hat 安全公告 2006:0754：

更新后的 GnuPG 程序包修复了两个安全问题，现在可用。

Red Hat 安全响应团队将此更新评级为具有重要安全影响。

GnuPG 是用于加密数据和创建数字签名的实用工具。

Tavis Ormandy 在 GnuPG 对消息进行解密的方式中发现一个堆栈覆盖缺陷。攻击者可创建精心构建的消息，如果受害者尝试解密该消息，可能导致 GnuPG 执行任意代码。(CVE-2006-6235)

在 GnuPG 构建要在交互式会话期间写入终端的消息的方式中发现一个基于堆的缓冲区溢出缺陷。攻击者可创建精心构建的消息，通过用户交互，可导致 GnuPG 以运行 GnuPG 的用户的权限执行任意代码。
(CVE-2006-6169)

建议所有 GnuPG 用户升级此更新后的程序包，其中包含用于修正这些问题的向后移植的修补程序。

- Specially crafted files could overflow a buffer when gpg     was used in interactive mode (CVE-2006-6169).

  - Specially crafted files could modify a function pointer     and execute code this way (CVE-2006-6235).

From Red Hat Security Advisory 2006:0754 :

Updated GnuPG packages that fix two security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Tavis Ormandy discovered a stack overwrite flaw in the way GnuPG decrypts messages. An attacker could create carefully crafted message that could cause GnuPG to execute arbitrary code if a victim attempts to decrypt the message. (CVE-2006-6235)

A heap based buffer overflow flaw was found in the way GnuPG constructs messages to be written to the terminal during an interactive session. An attacker could create a carefully crafted message which with user interaction could cause GnuPG to execute arbitrary code with the permissions of the user running GnuPG.
(CVE-2006-6169)

All users of GnuPG are advised to upgrade to this updated package, which contains a backported patch to correct these issues.

Updated GnuPG packages that fix two security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Tavis Ormandy discovered a stack overwrite flaw in the way GnuPG decrypts messages. An attacker could create carefully crafted message that could cause GnuPG to execute arbitrary code if a victim attempts to decrypt the message. (CVE-2006-6235)

A heap based buffer overflow flaw was found in the way GnuPG constructs messages to be written to the terminal during an interactive session. An attacker could create a carefully crafted message which with user interaction could cause GnuPG to execute arbitrary code with the permissions of the user running GnuPG.
(CVE-2006-6169)

All users of GnuPG are advised to upgrade to this updated package, which contains a backported patch to correct these issues.

- Specially crafted files could overflow a buffer when     gpg2 was used in interactive mode (CVE-2006-6169).

  - Specially crafted files could modify a function pointer     and execute code this way (CVE-2006-6235).

A buffer overflow was discovered in GnuPG. By tricking a user into running gpg interactively on a specially crafted message, an attacker could execute arbitrary code with the user's privileges. This vulnerability is not exposed when running gpg in batch mode.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in the GNU privacy guard, a free PGP replacement, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-6169     Werner Koch discovered that a buffer overflow in a     sanitising function may lead to execution of arbitrary     code when running gnupg interactively.

  - CVE-2006-6235     Tavis Ormandy discovered that parsing a carefully     crafted OpenPGP packet may lead to the execution of     arbitrary code, as a function pointer of an internal     structure may be controlled through the decryption     routines.

The remote host is affected by the vulnerability described in GLSA-200612-03 (GnuPG: Multiple vulnerabilities)

    Hugh Warrington has reported a boundary error in GnuPG, in the     'ask_outfile_name()' function from openfile.c: the     make_printable_string() function could return a string longer than     expected. Additionally, Tavis Ormandy of the Gentoo Security Team     reported a design error in which a function pointer can be incorrectly     dereferenced.
  Impact :

    A remote attacker could entice a user to interactively use GnuPG on a     crafted file and trigger the boundary error, which will result in a     buffer overflow. They could also entice a user to process a signed or     encrypted file with gpg or gpgv, possibly called through another     application like a mail client, to trigger the dereference error. Both     of these vulnerabilities would result in the execution of arbitrary     code with the permissions of the user running GnuPG. gpg-agent, gpgsm     and other tools are not affected.
  Workaround :

    There is no known workaround at this time.

- Specially crafted files could overflow a buffer when     gpg2 was used in interactive mode. (CVE-2006-6169)

  - Specially crafted files could modify a function pointer     and execute code this way. (CVE-2006-6235)

Buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages that cause the make_printable_string function to return a longer string than expected while constructing a prompt.

Updated packages have been patched to correct this issue.

USN-389-1 and USN-393-1 fixed vulnerabilities in gnupg. This update provides the corresponding updates for gnupg2.

A buffer overflow was discovered in GnuPG. By tricking a user into running gpg interactively on a specially crafted message, an attacker could execute arbitrary code with the user's privileges. This vulnerability is not exposed when running gpg in batch mode.
(CVE-2006-6169)

Tavis Ormandy discovered that gnupg was incorrectly using the stack. If a user were tricked into processing a specially crafted message, an attacker could execute arbitrary code with the user's privileges. (CVE-2006-6235).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
67429	Oracle Linux 4：gnupg（ELSA-2006-0754）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	critical
24662	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 9.0 / 9.1 : gnupg (SSA:2006-340-01)	Nessus	Slackware Local Security Checks	2007/2/18	2021/1/14	critical
67429	Oracle Linux 4 : gnupg (ELSA-2006-0754)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	critical
67429	Oracle Linux 4：gnupg (ELSA-2006-0754)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	critical
27247	openSUSE 10 Security Update : gpg (gpg-2388)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	critical
67429	Oracle Linux 4 : gnupg (ELSA-2006-0754)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	critical
23789	CentOS 3 / 4 : gnupg (CESA-2006:0754)	Nessus	CentOS Local Security Checks	2006/12/11	2021/1/4	critical
27251	openSUSE 10 Security Update : gpg2 (gpg2-2352)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	critical
27972	Ubuntu 5.10 / 6.06 LTS / 6.10 : gnupg vulnerability (USN-389-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
23792	Debian DSA-1231-1 : gnupg - several vulnerabilities	Nessus	Debian Local Security Checks	2006/12/11	2021/1/4	critical
23855	GLSA-200612-03 : GnuPG: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2006/12/14	2021/1/6	critical
29449	SuSE 10 Security Update : gpg (ZYPP Patch Number 2355)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	critical
23798	RHEL 2.1 / 3 / 4 : gnupg (RHSA-2006:0754)	Nessus	Red Hat Local Security Checks	2006/12/11	2021/1/14	critical
24605	Mandrake Linux Security Advisory : gnupg (MDKSA-2006:221)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	medium
29452	SuSE 10 Security Update : gpg2 (ZYPP Patch Number 2354)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	critical
27246	openSUSE 10 Security Update : gpg (gpg-2353)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	critical
27979	Ubuntu 6.10 : gnupg2 vulnerabilities (USN-393-2)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

critical

medium

critical

critical

critical