Red Hat セキュリティアドバイザリ 2006:0615 から：

セキュリティの問題を修正する更新済みの GnuPG パッケージが、現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新は重要度中のセキュリティ影響があると評価しています。

GnuPG は、データを暗号化し、デジタル署名を作成するためのユーティリティです。

GnuPG で整数オーバーフローの欠陥が見つかりました。攻撃者が、開いたときに GnuPG にクラッシュさせたり、メモリを上書きさせる可能性がある、大きな長さを持つ注意深く細工されたメッセージパケットを作成する可能性があります。
(CVE-2006-3746)

GnuPG の全ユーザーは、バックポートされたパッチが含まれるこれらの更新済みパッケージへアップグレードし、この問題を修正することが推奨されます。

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2006:0615 advisory.

  - GnuPG Parse_Comment Remote Buffer Overflow (CVE-2006-3746)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Evgeny Legerov discovered that overly large comments can crash gnupg, the GNU privacy guard - a free PGP replacement.

Updated GnuPG packages that fix a security issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

An integer overflow flaw was found in GnuPG. An attacker could create a carefully crafted message packet with a large length that could cause GnuPG to crash or possibly overwrite memory when opened.
(CVE-2006-3746)

All users of GnuPG are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

Evgeny Legerov discovered that overly large comments can crash gnupg, the GNU privacy guard - a free PGP replacement, which is also present in the development branch.

来自 Red Hat 安全公告 2006:0615：

更新后的 GnuPG 程序包修复了一个安全问题，现在可用。

Red Hat 安全响应团队将此更新评级为具有中等安全影响。

GnuPG 是用于加密数据和创建数字签名的实用工具。

在 GnuPG 中发现一个整数溢出缺陷。攻击者可创建精心构建的长消息数据包，打开该数据包可导致 GnuPG 崩溃或可能覆盖内存。
(CVE-2006-3746)

建议所有 GnuPG 用户升级这些更新后的程序包，其中包含用于修正此问题的向后移植的修补程序。

來自 Red Hat 安全性公告 2006:0615：

現已提供更新版 GnuPG 套件，可修正一個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。

GnuPG 是一套用於加密資料和建立數位簽章的公用程式。

在 GnuPG 中發現一個整數溢位瑕疵。攻擊者可建立長度極大的特製訊息封包，該封包開啟時可造成 GnuPG 損毀或可能覆寫記憶體。
(CVE-2006-3746)

建議所有 GnuPG 使用者皆升級至這些更新版套件，其中包含可更正此問題的反向移植修補程式。

The remote host is affected by the vulnerability described in GLSA-200608-08 (GnuPG: Integer overflow vulnerability)

    Evgeny Legerov discovered a vulnerability in GnuPG that when certain     packets are handled an integer overflow may occur.
  Impact :

    By sending a specially crafted email to a user running an affected     version of GnuPG, a remote attacker could possibly execute arbitrary     code with the permissions of the user running GnuPG.
  Workaround :

    There is no known workaround at this time.

An integer overflow vulnerability was discovered in gnupg where an attacker could create a carefully-crafted message packet with a large length that could cause gnupg to crash or possibly overwrite memory when opened.

Updated packages have been patched to correct this issue.

This update of gpg2 fixes an segmentation fault when using the--no-armor option. This failure leads to a denial-of-service attack and may be used execute arbitrary code. (CVE-2006-3746)

From Red Hat Security Advisory 2006:0615 :

Updated GnuPG packages that fix a security issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

An integer overflow flaw was found in GnuPG. An attacker could create a carefully crafted message packet with a large length that could cause GnuPG to crash or possibly overwrite memory when opened.
(CVE-2006-3746)

All users of GnuPG are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

This update of gpg fixes an segmentation fault when using the--no-armor option. This failure leads to a denial-of-service attack and may be used execute arbitrary code. (CVE-2006-3746)

Evgeny Legerov discovered that gnupg did not sufficiently check the validity of the comment and a control field. Specially crafted GPG data could cause a buffer overflow. This could be exploited to execute arbitrary code with the user's privileges if an attacker can trick an user into processing a malicious encrypted/signed document with gnupg.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
67400	Oracle Linux 4：gnupg（ELSA-2006-0615）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
22151	RHEL 4 : gnupg (RHSA-2006:0615)	Nessus	Red Hat Local Security Checks	2006/8/4	2024/4/21	critical
22682	Debian DSA-1140-1 : gnupg - integer overflow	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
22164	CentOS 3 / 4 : gnupg (CESA-2006:0615)	Nessus	CentOS Local Security Checks	2006/8/7	2021/1/4	medium
22683	Debian DSA-1141-1 : gnupg2 - integer overflow	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
67400	Oracle Linux 4：gnupg (ELSA-2006-0615)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
67400	Oracle Linux 4 : gnupg (ELSA-2006-0615)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
22166	GLSA-200608-08 : GnuPG: Integer overflow vulnerability	Nessus	Gentoo Local Security Checks	2006/8/7	2021/1/6	medium
23890	Mandrake Linux Security Advisory : gnupg (MDKSA-2006:141)	Nessus	Mandriva Local Security Checks	2006/12/16	2021/1/6	medium
27250	openSUSE 10 Security Update : gpg2 (gpg2-1956)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	medium
67400	Oracle Linux 4 : gnupg (ELSA-2006-0615)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
29448	SuSE 10 Security Update : gpg (ZYPP Patch Number 1959)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	medium
27245	openSUSE 10 Security Update : gpg (gpg-1955)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	medium
27911	Ubuntu 5.04 / 5.10 / 6.06 LTS : gnupg vulnerability (USN-332-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium

偵測

搜尋 Plugin

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium