Updated GnuPG packages that fix a security issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

An integer overflow flaw was found in GnuPG. An attacker could create a carefully crafted message packet with a large length that could cause GnuPG to crash or possibly overwrite memory when opened.
(CVE-2006-3746)

All users of GnuPG are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

Evgeny Legerov discovered that overly large comments can crash gnupg, the GNU privacy guard - a free PGP replacement, which is also present in the development branch.

Evgeny Legerov discovered that overly large comments can crash gnupg, the GNU privacy guard - a free PGP replacement.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2006:0615 advisory.

  - GnuPG Parse_Comment Remote Buffer Overflow (CVE-2006-3746)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200608-08 (GnuPG: Integer overflow vulnerability)

    Evgeny Legerov discovered a vulnerability in GnuPG that when certain     packets are handled an integer overflow may occur.
  Impact :

    By sending a specially crafted email to a user running an affected     version of GnuPG, a remote attacker could possibly execute arbitrary     code with the permissions of the user running GnuPG.
  Workaround :

    There is no known workaround at this time.

An integer overflow vulnerability was discovered in gnupg where an attacker could create a carefully-crafted message packet with a large length that could cause gnupg to crash or possibly overwrite memory when opened.

Updated packages have been patched to correct this issue.

This update of gpg2 fixes an segmentation fault when using the--no-armor option. This failure leads to a denial-of-service attack and may be used execute arbitrary code. (CVE-2006-3746)

From Red Hat Security Advisory 2006:0615 :

Updated GnuPG packages that fix a security issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

An integer overflow flaw was found in GnuPG. An attacker could create a carefully crafted message packet with a large length that could cause GnuPG to crash or possibly overwrite memory when opened.
(CVE-2006-3746)

All users of GnuPG are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

This update of gpg fixes an segmentation fault when using the--no-armor option. This failure leads to a denial-of-service attack and may be used execute arbitrary code. (CVE-2006-3746)

Evgeny Legerov discovered that gnupg did not sufficiently check the validity of the comment and a control field. Specially crafted GPG data could cause a buffer overflow. This could be exploited to execute arbitrary code with the user's privileges if an attacker can trick an user into processing a malicious encrypted/signed document with gnupg.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
22164	CentOS 3 / 4 : gnupg (CESA-2006:0615)	Nessus	CentOS Local Security Checks	8/7/2006	1/4/2021	medium
22683	Debian DSA-1141-1 : gnupg2 - integer overflow	Nessus	Debian Local Security Checks	10/14/2006	1/4/2021	medium
22682	Debian DSA-1140-1 : gnupg - integer overflow	Nessus	Debian Local Security Checks	10/14/2006	1/4/2021	medium
22151	RHEL 4 : gnupg (RHSA-2006:0615)	Nessus	Red Hat Local Security Checks	8/4/2006	4/21/2024	critical
22166	GLSA-200608-08 : GnuPG: Integer overflow vulnerability	Nessus	Gentoo Local Security Checks	8/7/2006	1/6/2021	medium
23890	Mandrake Linux Security Advisory : gnupg (MDKSA-2006:141)	Nessus	Mandriva Local Security Checks	12/16/2006	1/6/2021	medium
27250	openSUSE 10 Security Update : gpg2 (gpg2-1956)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	medium
67400	Oracle Linux 4 : gnupg (ELSA-2006-0615)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
29448	SuSE 10 Security Update : gpg (ZYPP Patch Number 1959)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	medium
27245	openSUSE 10 Security Update : gpg (gpg-1955)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	medium
27911	Ubuntu 5.04 / 5.10 / 6.06 LTS : gnupg vulnerability (USN-332-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium