GnuPG Parse_User_ID Remote Buffer Overflow Vulnerability
BID:18554
CVE-2006-3082 |Info
GnuPG Parse_User_ID Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 18554 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2006-3082 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 20 2006 12:00AM |
| Updated: | Mar 19 2015 09:08AM |
| Credit: | Evgeny Legerov discovered this issue. |
| Vulnerable: |
Ubuntu Ubuntu Linux 5.10 sparc Ubuntu Ubuntu Linux 5.10 powerpc Ubuntu Ubuntu Linux 5.10 i386 Ubuntu Ubuntu Linux 5.10 amd64 Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu Ubuntu Linux 5.0 4 i386 Ubuntu Ubuntu Linux 5.0 4 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Secure Enterprise Linux 2.0 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 10 SuSE SUSE Linux Enterprise Desktop 10 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 SGI ProPack 3.0 SP6 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Open-Enterprise-Server 1 S.u.S.E. Office Server S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Openexchange Server S.u.S.E. Linux Office Server S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Desktop 1.0 S.u.S.E. Linux Database Server 0 S.u.S.E. Linux Connectivity Server rPath rPath Linux 1 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux WS 2.1 IA64 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux ES 2.1 IA64 RedHat Enterprise Linux ES 2.1 RedHat Desktop 4.0 RedHat Desktop 3.0 RedHat Advanced Workstation for the Itanium Processor 2.1 IA64 RedHat Advanced Workstation for the Itanium Processor 2.1 Red Hat Fedora Core6 Red Hat Fedora Core5 Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux AS 2.1 IA64 Red Hat Enterprise Linux AS 2.1 OpenPKG OpenPKG 2.5 OpenPKG OpenPKG 2.2 OpenPKG OpenPKG Current Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 GNU GNU Privacy Guard 1.9.20 GNU GNU Privacy Guard 1.9.15 GNU GNU Privacy Guard 1.4.3 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 Avaya S8710 R2.0.1 Avaya S8710 R2.0.0 Avaya S8700 R2.0.1 Avaya S8700 R2.0.0 Avaya S8500 R2.0.1 Avaya S8500 R2.0.0 Avaya S8300 R2.0.1 Avaya S8300 R2.0.0 Avaya Messaging Storage Server Avaya Message Networking Avaya Intuity LX Avaya Converged Communications Server 2.0 |
| Not Vulnerable: |
GNU GNU Privacy Guard 1.4.4 |
Discussion
GnuPG Parse_User_ID Remote Buffer Overflow Vulnerability
GnuPG is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
This issue may allow remote attackers to execute arbitrary machine code in the context of the affected application, but this has not been confirmed.
GnuPG versions 1.4.3 and 1.9.20 are vulnerable to this issue; previous versions may also be affected.
GnuPG is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
This issue may allow remote attackers to execute arbitrary machine code in the context of the affected application, but this has not been confirmed.
GnuPG versions 1.4.3 and 1.9.20 are vulnerable to this issue; previous versions may also be affected.
Exploit / POC
GnuPG Parse_User_ID Remote Buffer Overflow Vulnerability
The following Perl command demonstrates this issue by crashing the affected application:
perl -e 'print "\xcd\xff\xff\xff\xff\xfe"'| /var/gnupg/bin/gpg --no-armor
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
The following Perl command demonstrates this issue by crashing the affected application:
perl -e 'print "\xcd\xff\xff\xff\xff\xfe"'| /var/gnupg/bin/gpg --no-armor
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
GnuPG Parse_User_ID Remote Buffer Overflow Vulnerability
Solution:
The vendor has released version 1.4.4 of GNUPG to address this issue.
Please see the referenced advisories for information on obtaining and applying fixes.
GNU GNU Privacy Guard 1.9.15
Solution:
The vendor has released version 1.4.4 of GNUPG to address this issue.
Please see the referenced advisories for information on obtaining and applying fixes.
GNU GNU Privacy Guard 1.9.15
-
Debian gnupg-agent_1.9.15-6sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_alpha.deb -
Debian gnupg-agent_1.9.15-6sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_amd64.deb -
Debian gnupg-agent_1.9.15-6sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_arm.deb -
Debian gnupg-agent_1.9.15-6sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_hppa.deb -
Debian gnupg-agent_1.9.15-6sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_i386.deb -
Debian gnupg-agent_1.9.15-6sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_ia64.deb -
Debian gnupg-agent_1.9.15-6sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_m68k.deb -
Debian gnupg-agent_1.9.15-6sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_mips.deb -
Debian gnupg-agent_1.9.15-6sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_mipsel.deb -
Debian gnupg-agent_1.9.15-6sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_powerpc.deb -
Debian gnupg-agent_1.9.15-6sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_s390.deb -
Debian gnupg-agent_1.9.15-6sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9. 15-6sarge1_sparc.deb -
Debian gnupg2_1.9.15-6sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_alpha.deb -
Debian gnupg2_1.9.15-6sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_amd64.deb -
Debian gnupg2_1.9.15-6sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_arm.deb -
Debian gnupg2_1.9.15-6sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_hppa.deb -
Debian gnupg2_1.9.15-6sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_i386.deb -
Debian gnupg2_1.9.15-6sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_ia64.deb -
Debian gnupg2_1.9.15-6sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_m68k.deb -
Debian gnupg2_1.9.15-6sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_mips.deb -
Debian gnupg2_1.9.15-6sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_mipsel.deb -
Debian gnupg2_1.9.15-6sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_powerpc.deb -
Debian gnupg2_1.9.15-6sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_s390.deb -
Debian gnupg2_1.9.15-6sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6s arge1_sparc.deb -
Debian gpgsm_1.9.15-6sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_alpha.deb -
Debian gpgsm_1.9.15-6sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_amd64.deb -
Debian gpgsm_1.9.15-6sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_arm.deb -
Debian gpgsm_1.9.15-6sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_hppa.deb -
Debian gpgsm_1.9.15-6sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_i386.deb -
Debian gpgsm_1.9.15-6sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_ia64.deb -
Debian gpgsm_1.9.15-6sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_m68k.deb -
Debian gpgsm_1.9.15-6sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_mips.deb -
Debian gpgsm_1.9.15-6sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_mipsel.deb -
Debian gpgsm_1.9.15-6sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_powerpc.deb -
Debian gpgsm_1.9.15-6sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_s390.deb -
Debian gpgsm_1.9.15-6sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sa rge1_sparc.deb
References
GnuPG Parse_User_ID Remote Buffer Overflow Vulnerability
References:
References:
- ASA-2006-167 - gnupg security update (RHSA-2006-0571) (Avaya)
- GnuPG Homepage (GnuPG)
- GnuPG: trunk/g10/parse-packet.c (GNU)
- RHSA-2006:0571-4 - gnupg security update (RedHat)
- rPSA-2006-0120-1 gnupg (Justin M. Forbes)