A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.

From Red Hat Security Advisory 2006:0754 :

Updated GnuPG packages that fix two security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Tavis Ormandy discovered a stack overwrite flaw in the way GnuPG decrypts messages. An attacker could create carefully crafted message that could cause GnuPG to execute arbitrary code if a victim attempts to decrypt the message. (CVE-2006-6235)

A heap based buffer overflow flaw was found in the way GnuPG constructs messages to be written to the terminal during an interactive session. An attacker could create a carefully crafted message which with user interaction could cause GnuPG to execute arbitrary code with the permissions of the user running GnuPG.
(CVE-2006-6169)

All users of GnuPG are advised to upgrade to this updated package, which contains a backported patch to correct these issues.

- Specially crafted files could overflow a buffer when     gpg2 was used in interactive mode. (CVE-2006-6169)

  - Specially crafted files could modify a function pointer     and execute code this way. (CVE-2006-6235)

USN-389-1 and USN-393-1 fixed vulnerabilities in gnupg. This update provides the corresponding updates for gnupg2.

A buffer overflow was discovered in GnuPG. By tricking a user into running gpg interactively on a specially crafted message, an attacker could execute arbitrary code with the user's privileges. This vulnerability is not exposed when running gpg in batch mode.
(CVE-2006-6169)

Tavis Ormandy discovered that gnupg was incorrectly using the stack. If a user were tricked into processing a specially crafted message, an attacker could execute arbitrary code with the user's privileges. (CVE-2006-6235).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tavis Ormandy discovered that gnupg was incorrectly using the stack.
If a user were tricked into processing a specially crafted message, an attacker could execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Specially crafted files could overflow a buffer when     gpg2 was used in interactive mode (CVE-2006-6169).

  - Specially crafted files could modify a function pointer     and execute code this way (CVE-2006-6235).

- Specially crafted files could overflow a buffer when gpg     was used in interactive mode (CVE-2006-6169).

  - Specially crafted files could modify a function pointer     and execute code this way (CVE-2006-6235).

New gnupg packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix security issues.

A 'stack overwrite' vulnerability in GnuPG (gpg) allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.

Updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200612-03 (GnuPG: Multiple vulnerabilities)

    Hugh Warrington has reported a boundary error in GnuPG, in the     'ask_outfile_name()' function from openfile.c: the     make_printable_string() function could return a string longer than     expected. Additionally, Tavis Ormandy of the Gentoo Security Team     reported a design error in which a function pointer can be incorrectly     dereferenced.
  Impact :

    A remote attacker could entice a user to interactively use GnuPG on a     crafted file and trigger the boundary error, which will result in a     buffer overflow. They could also entice a user to process a signed or     encrypted file with gpg or gpgv, possibly called through another     application like a mail client, to trigger the dereference error. Both     of these vulnerabilities would result in the execution of arbitrary     code with the permissions of the user running GnuPG. gpg-agent, gpgsm     and other tools are not affected.
  Workaround :

    There is no known workaround at this time.

Updated GnuPG packages that fix two security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Tavis Ormandy discovered a stack overwrite flaw in the way GnuPG decrypts messages. An attacker could create carefully crafted message that could cause GnuPG to execute arbitrary code if a victim attempts to decrypt the message. (CVE-2006-6235)

A heap based buffer overflow flaw was found in the way GnuPG constructs messages to be written to the terminal during an interactive session. An attacker could create a carefully crafted message which with user interaction could cause GnuPG to execute arbitrary code with the permissions of the user running GnuPG.
(CVE-2006-6169)

All users of GnuPG are advised to upgrade to this updated package, which contains a backported patch to correct these issues.

Werner Koch reports :

GnuPG uses data structures called filters to process OpenPGP messages.
These filters are used in a similar way as a pipelines in the shell.
For communication between these filters context structures are used.
These are usually allocated on the stack and passed to the filter functions. At most places the OpenPGP data stream fed into these filters is closed before the context structure gets deallocated. While decrypting encrypted packets, this may not happen in all cases and the filter may use a void contest structure filled with garbage. An attacker may control this garbage. The filter context includes another context used by the low-level decryption to access the decryption algorithm. This is done using a function pointer. By carefully crafting an OpenPGP message, an attacker may control this function pointer and call an arbitrary function of the process. Obviously an exploit needs to prepared for a specific version, compiler, libc, etc to be successful - but it is definitely doable.

Fixing this is obvious: We need to allocate the context on the heap and use a reference count to keep it valid as long as either the controlling code or the filter code needs it.

We have checked all other usages of such a stack based filter contexts but fortunately found no other vulnerable places. This allows to release a relatively small patch. However, for reasons of code cleanness and easier audits we will soon start to change all these stack based filter contexts to heap based ones.

Several remote vulnerabilities have been discovered in the GNU privacy guard, a free PGP replacement, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-6169     Werner Koch discovered that a buffer overflow in a     sanitising function may lead to execution of arbitrary     code when running gnupg interactively.

  - CVE-2006-6235     Tavis Ormandy discovered that parsing a carefully     crafted OpenPGP packet may lead to the execution of     arbitrary code, as a function pointer of an internal     structure may be controlled through the decryption     routines.

ID	Name	Product	Family	Severity
67429	Oracle Linux 4 : gnupg (ELSA-2006-0754)	Nessus	Oracle Linux Local Security Checks	critical
29452	SuSE 10 Security Update : gpg2 (ZYPP Patch Number 2354)	Nessus	SuSE Local Security Checks	critical
29449	SuSE 10 Security Update : gpg (ZYPP Patch Number 2355)	Nessus	SuSE Local Security Checks	critical
27979	Ubuntu 6.10 : gnupg2 vulnerabilities (USN-393-2)	Nessus	Ubuntu Local Security Checks	critical
27978	Ubuntu 5.10 / 6.06 LTS / 6.10 : gnupg vulnerability (USN-393-1)	Nessus	Ubuntu Local Security Checks	critical
27251	openSUSE 10 Security Update : gpg2 (gpg2-2352)	Nessus	SuSE Local Security Checks	critical
27247	openSUSE 10 Security Update : gpg (gpg-2388)	Nessus	SuSE Local Security Checks	critical
27246	openSUSE 10 Security Update : gpg (gpg-2353)	Nessus	SuSE Local Security Checks	critical
24662	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 9.0 / 9.1 : gnupg (SSA:2006-340-01)	Nessus	Slackware Local Security Checks	critical
24611	Mandrake Linux Security Advisory : gnupg (MDKSA-2006:228)	Nessus	Mandriva Local Security Checks	critical
23855	GLSA-200612-03 : GnuPG: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
23798	RHEL 2.1 / 3 / 4 : gnupg (RHSA-2006:0754)	Nessus	Red Hat Local Security Checks	critical
23794	FreeBSD : gnupg -- remotely controllable function pointer (4db1669c-8589-11db-ac4f-02e081235dab)	Nessus	FreeBSD Local Security Checks	critical
23792	Debian DSA-1231-1 : gnupg - several vulnerabilities	Nessus	Debian Local Security Checks	critical
23789	CentOS 3 / 4 : gnupg (CESA-2006:0754)	Nessus	CentOS Local Security Checks	critical

Detections

Analytics

CVE-2006-6235

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical