Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.

From Red Hat Security Advisory 2006:0615 :

Updated GnuPG packages that fix a security issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

An integer overflow flaw was found in GnuPG. An attacker could create a carefully crafted message packet with a large length that could cause GnuPG to crash or possibly overwrite memory when opened.
(CVE-2006-3746)

All users of GnuPG are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

This update of gpg fixes an segmentation fault when using the--no-armor option. This failure leads to a denial-of-service attack and may be used execute arbitrary code. (CVE-2006-3746)

Evgeny Legerov discovered that gnupg did not sufficiently check the validity of the comment and a control field. Specially crafted GPG data could cause a buffer overflow. This could be exploited to execute arbitrary code with the user's privileges if an attacker can trick an user into processing a malicious encrypted/signed document with gnupg.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of gpg2 fixes an segmentation fault when using the--no-armor option. This failure leads to a denial-of-service attack and may be used execute arbitrary code. (CVE-2006-3746)

An integer overflow vulnerability was discovered in gnupg where an attacker could create a carefully-crafted message packet with a large length that could cause gnupg to crash or possibly overwrite memory when opened.

Updated packages have been patched to correct this issue.

Evgeny Legerov discovered that overly large comments can crash gnupg, the GNU privacy guard - a free PGP replacement, which is also present in the development branch.

Evgeny Legerov discovered that overly large comments can crash gnupg, the GNU privacy guard - a free PGP replacement.

The remote host is affected by the vulnerability described in GLSA-200608-08 (GnuPG: Integer overflow vulnerability)

    Evgeny Legerov discovered a vulnerability in GnuPG that when certain     packets are handled an integer overflow may occur.
  Impact :

    By sending a specially crafted email to a user running an affected     version of GnuPG, a remote attacker could possibly execute arbitrary     code with the permissions of the user running GnuPG.
  Workaround :

    There is no known workaround at this time.

Updated GnuPG packages that fix a security issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

An integer overflow flaw was found in GnuPG. An attacker could create a carefully crafted message packet with a large length that could cause GnuPG to crash or possibly overwrite memory when opened.
(CVE-2006-3746)

All users of GnuPG are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2006:0615 advisory.

  - GnuPG Parse_Comment Remote Buffer Overflow (CVE-2006-3746)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
67400	Oracle Linux 4 : gnupg (ELSA-2006-0615)	Nessus	Oracle Linux Local Security Checks	medium
29448	SuSE 10 Security Update : gpg (ZYPP Patch Number 1959)	Nessus	SuSE Local Security Checks	medium
27911	Ubuntu 5.04 / 5.10 / 6.06 LTS : gnupg vulnerability (USN-332-1)	Nessus	Ubuntu Local Security Checks	medium
27250	openSUSE 10 Security Update : gpg2 (gpg2-1956)	Nessus	SuSE Local Security Checks	medium
27245	openSUSE 10 Security Update : gpg (gpg-1955)	Nessus	SuSE Local Security Checks	medium
23890	Mandrake Linux Security Advisory : gnupg (MDKSA-2006:141)	Nessus	Mandriva Local Security Checks	medium
22683	Debian DSA-1141-1 : gnupg2 - integer overflow	Nessus	Debian Local Security Checks	medium
22682	Debian DSA-1140-1 : gnupg - integer overflow	Nessus	Debian Local Security Checks	medium
22166	GLSA-200608-08 : GnuPG: Integer overflow vulnerability	Nessus	Gentoo Local Security Checks	medium
22164	CentOS 3 / 4 : gnupg (CESA-2006:0615)	Nessus	CentOS Local Security Checks	medium
22151	RHEL 4 : gnupg (RHSA-2006:0615)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2006-3746

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical