Debian DSA-1266-1 : gnupg - several vulnerabilities

medium Nessus Plugin ID 24819

Synopsis

The remote Debian host is missing a security-related update.

Description

Gerardo Richarte discovered that GnuPG, a free PGP replacement, provides insufficient user feedback if an OpenPGP message contains both unsigned and signed portions. Inserting text segments into an otherwise signed message could be exploited to forge the content of signed messages. This update prevents such attacks; the old behaviour can still be activated by passing the --allow-multiple-messages option.

Solution

Upgrade the gnupg packages.

For the stable distribution (sarge) these problems have been fixed in version 1.4.1-1.sarge7.

For the upcoming stable distribution (etch) these problems have been fixed in version 1.4.6-2.

Plugin Details

Severity: Medium

ID: 24819

File Name: debian_DSA-1266.nasl

Version: 1.13

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 3/16/2007

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:gnupg, cpe:/o:debian:debian_linux:3.1

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 3/13/2007

Reference Information

CVE: CVE-2007-1263

DSA: 1266

Detections

Analytics