5 - CVE-2013-4402

Executive Summary

Informations
Name	CVE-2013-4402	First vendor Publication	2013-10-28
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4402

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-20	Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:19160

Oval ID:	oval:org.mitre.oval:def:19160
Title:	USN-1987-1 -- gnupg, gnupg2 vulnerabilities
Description:	Several security issues were fixed in GnuPG.
Family:	unix	Class:	patch
Reference(s):	USN-1987-1 CVE-2013-4351 CVE-2013-4402	Version:	5
Platform(s):	Ubuntu 13.04 Ubuntu 12.10 Ubuntu 12.04 Ubuntu 10.04	Product(s):	gnupg gnupg2
Definition Synopsis:
Release section Ubuntu 13.04 is installed Packages match section gnupg DPKG is earlier than 0:1.4.12-7ubuntu1.2 AND gnupg2 DPKG is earlier than 0:2.0.19-2ubuntu1.1 AND Release section Ubuntu 12.10 is installed Packages match section gnupg DPKG is earlier than 0:1.4.11-3ubuntu4.3 AND gnupg2 DPKG is earlier than 0:2.0.17-2ubuntu3.2 AND Release section Ubuntu 12.04 is installed Packages match section gnupg DPKG is earlier than 0:1.4.11-3ubuntu2.4 AND gnupg2 DPKG is earlier than 0:2.0.17-2ubuntu2.12.04.3 AND Release section Ubuntu 10.04 is installed Packages match section gnupg DPKG is earlier than 0:1.4.10-2ubuntu1.4 AND gnupg2 DPKG is earlier than 0:2.0.14-1ubuntu1.6

Definition Id: oval:org.mitre.oval:def:19904

Oval ID:	oval:org.mitre.oval:def:19904
Title:	DSA-2773-1 gnupg - several
Description:	Two vulnerabilities were discovered in GnuPG, the GNU privacy guard, a free PGP replacement.
Family:	unix	Class:	patch
Reference(s):	DSA-2773-1 CVE-2013-4351 CVE-2013-4402	Version:	5
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7	Product(s):	gnupg
Definition Synopsis:
Release section Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND gnupg DPKG is earlier than 0:1.4.10-4+squeeze3 AND Release section Debian 7 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND gnupg DPKG is earlier than 0:1.4.12-7+deb7u2

Definition Id: oval:org.mitre.oval:def:20090

Oval ID:	oval:org.mitre.oval:def:20090
Title:	DSA-2774-1 gnupg2 - several
Description:	Two vulnerabilities were discovered in GnuPG 2, the GNU privacy guard, a free PGP replacement.
Family:	unix	Class:	patch
Reference(s):	DSA-2774-1 CVE-2013-4351 CVE-2013-4402	Version:	5
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7	Product(s):	gnupg2
Definition Synopsis:
Release section Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND gnupg2 DPKG is earlier than 0:2.0.14-2+squeeze2 AND Release section Debian 7 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND gnupg2 DPKG is earlier than 0:2.0.19-2+deb7u1

Definition Id: oval:org.mitre.oval:def:20690

Oval ID:	oval:org.mitre.oval:def:20690
Title:	RHSA-2013:1459: gnupg2 security update (Moderate)
Description:	The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Family:	unix	Class:	patch
Reference(s):	RHSA-2013:1459-00 CESA-2013:1459 CVE-2012-6085 CVE-2013-4351 CVE-2013-4402	Version:	45
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 CentOS Linux 5 CentOS Linux 6	Product(s):	gnupg2
Definition Synopsis:
Operation system section Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND CentOS Linux 6.x Packages section gnupg2 is earlier than 0:2.0.14-6.el6_4 AND gnupg2-smime is earlier than 0:2.0.14-6.el6_4 AND Operation system section Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND gnupg2 is earlier than 0:2.0.10-6.el5_10

Definition Id: oval:org.mitre.oval:def:20833

Oval ID:	oval:org.mitre.oval:def:20833
Title:	RHSA-2013:1458: gnupg security update (Moderate)
Description:	The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Family:	unix	Class:	patch
Reference(s):	RHSA-2013:1458-00 CESA-2013:1458 CVE-2012-6085 CVE-2013-4242 CVE-2013-4351 CVE-2013-4402	Version:	59
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	gnupg
Definition Synopsis:
Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND gnupg is earlier than 0:1.4.5-18.el5_10

Definition Id: oval:org.mitre.oval:def:23451

Oval ID:	oval:org.mitre.oval:def:23451
Title:	ELSA-2013:1458: gnupg security update (Moderate)
Description:	The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Family:	unix	Class:	patch
Reference(s):	ELSA-2013:1458-00 CVE-2012-6085 CVE-2013-4242 CVE-2013-4351 CVE-2013-4402	Version:	21
Platform(s):	Oracle Linux 5	Product(s):	gnupg
Definition Synopsis:
Oracle Linux 5.x AND gnupg is earlier than 0:1.4.5-18.el5_10

Definition Id: oval:org.mitre.oval:def:23470

Oval ID:	oval:org.mitre.oval:def:23470
Title:	DEPRECATED: ELSA-2013:1459: gnupg2 security update (Moderate)
Description:	The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Family:	unix	Class:	patch
Reference(s):	ELSA-2013:1459-00 CVE-2012-6085 CVE-2013-4351 CVE-2013-4402	Version:	18
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	gnupg2
Definition Synopsis:
rpm test Oracle Linux 6.x AND rpm test gnupg2 is earlier than 0:2.0.14-6.el6_4 AND gnupg2-smime is earlier than 0:2.0.14-6.el6_4 OR rpm test Oracle Linux 5.x AND gnupg2 is earlier than 0:2.0.10-6.el5_10

Definition Id: oval:org.mitre.oval:def:23894

Oval ID:	oval:org.mitre.oval:def:23894
Title:	ELSA-2013:1459: gnupg2 security update (Moderate)
Description:	The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Family:	unix	Class:	patch
Reference(s):	ELSA-2013:1459-00 CVE-2012-6085 CVE-2013-4351 CVE-2013-4402	Version:	17
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	gnupg2
Definition Synopsis:
rpm test Oracle Linux 6.x AND rpm test gnupg2 is earlier than 0:2.0.14-6.el6_4 AND gnupg2-smime is earlier than 0:2.0.14-6.el6_4 OR rpm test Oracle Linux 5.x AND gnupg2 is earlier than 0:2.0.10-6.el5_10

Definition Id: oval:org.mitre.oval:def:25288

Oval ID:	oval:org.mitre.oval:def:25288
Title:	SUSE-SU-2013:1576-1 -- Security update for gpg2
Description:	This GnuPG update fixes two security issues: * CVE-2013-4351: GnuPG treated no-usage-permitted keys as all-usages-permitted. * CVE-2013-4402: An infinite recursion in the compressed packet parser was fixed.
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2013:1576-1 CVE-2013-4351 CVE-2013-4402	Version:	3
Platform(s):	SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11	Product(s):	gpg2
Definition Synopsis:
Operation system section SUSE Linux Enterprise Server 11.x is installed AND SUSE Linux Enterprise Desktop 11.x is installed Packages match section gpg2 RPM is earlier than 0:2.0.9-25.33.37.1 AND gpg2-lang RPM is earlier than 0:2.0.9-25.33.37.1

Definition Id: oval:org.mitre.oval:def:26955

Oval ID:	oval:org.mitre.oval:def:26955
Title:	DEPRECATED: ELSA-2013-1458 -- gnupg security update (moderate)
Description:	[1.4.5-18] - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted [1.4.5-17] - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation - fix CVE-2013-4242 GnuPG susceptible to Yarom/Falkner side-channel attack - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser [1.4.5-15] - fix error when decrypting certain files (#510500)
Family:	unix	Class:	patch
Reference(s):	ELSA-2013-1458 CVE-2013-4242 CVE-2012-6085 CVE-2013-4351 CVE-2013-4402	Version:	4
Platform(s):	Oracle Linux 5	Product(s):	gnupg
Definition Synopsis:
Oracle Linux 5.x AND gnupg is earlier than 0:1.4.5-18.el5_10

Definition Id: oval:org.mitre.oval:def:27428

Oval ID:	oval:org.mitre.oval:def:27428
Title:	DEPRECATED: ELSA-2013-1459 -- gnupg2 security update (moderate)
Description:	[2.0.14-6] - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted [2.0.14-5] - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser
Family:	unix	Class:	patch
Reference(s):	ELSA-2013-1459 CVE-2012-6085 CVE-2013-4351 CVE-2013-4402	Version:	4
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	gnupg2
Definition Synopsis:
Oracle Linux 5 release section Oracle Linux 5.x AND gnupg2 is earlier than 0:2.0.10-6.el5_10 AND Oracle Linux 6 release section Oracle Linux 6.x Packages match section gnupg2 is earlier than 0:2.0.14-6.el6_4 AND gnupg2-smime is earlier than 0:2.0.14-6.el6_4

CPE : Common Platform Enumeration

Type	Description	Count
Application	Gnupg cpe:2.3:a:gnupg:gnupg:2.0.21:::::::* cpe:2.3:a:gnupg:gnupg:2.0.20:::::::* cpe:2.3:a:gnupg:gnupg:2.0.19:::::::* cpe:2.3:a:gnupg:gnupg:2.0.18:::::::* cpe:2.3:a:gnupg:gnupg:2.0.17:::::::* cpe:2.3:a:gnupg:gnupg:2.0.16:::::::* cpe:2.3:a:gnupg:gnupg:2.0.15:::::::* cpe:2.3:a:gnupg:gnupg:2.0.14:::::::* cpe:2.3:a:gnupg:gnupg:2.0.13:::::::* cpe:2.3:a:gnupg:gnupg:2.0.12:::::::* cpe:2.3:a:gnupg:gnupg:2.0.11:::::::* cpe:2.3:a:gnupg:gnupg:2.0.10:::::::* cpe:2.3:a:gnupg:gnupg:2.0.1:::::::* cpe:2.3:a:gnupg:gnupg:2.0:::::::* cpe:2.3:a:gnupg:gnupg:1.4.8:::::::* cpe:2.3:a:gnupg:gnupg:1.4.5:::::::* cpe:2.3:a:gnupg:gnupg:1.4.4:::::::* cpe:2.3:a:gnupg:gnupg:1.4.3:::::::* cpe:2.3:a:gnupg:gnupg:1.4.2:::::::* cpe:2.3:a:gnupg:gnupg:1.4.14:::::::* cpe:2.3:a:gnupg:gnupg:1.4.13:::::::* cpe:2.3:a:gnupg:gnupg:1.4.12:::::::* cpe:2.3:a:gnupg:gnupg:1.4.11:::::::* cpe:2.3:a:gnupg:gnupg:1.4.10:::::::* cpe:2.3:a:gnupg:gnupg:1.4.0:::::::*	25
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:13.04:::::::* cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:::::* cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:::::*	4

Nessus® Vulnerability Scanner

Date	Description
2016-02-22	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL40131068.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_gnupg_20140731.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-758.nasl - Type : ACT_GATHER_INFO
2014-02-23	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201402-24.nasl - Type : ACT_GATHER_INFO
2013-11-14	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2013-236.nasl - Type : ACT_GATHER_INFO
2013-11-14	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2013-237.nasl - Type : ACT_GATHER_INFO
2013-11-13	Name : The remote Fedora host is missing a security update. File : fedora_2013-18647.nasl - Type : ACT_GATHER_INFO
2013-10-27	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-1459.nasl - Type : ACT_GATHER_INFO
2013-10-27	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2013-1458.nasl - Type : ACT_GATHER_INFO
2013-10-27	Name : The remote Fedora host is missing one or more security updates. File : fedora_2013-18814.nasl - Type : ACT_GATHER_INFO
2013-10-25	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_gpg2-131008.nasl - Type : ACT_GATHER_INFO
2013-10-25	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20131024_gnupg_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-10-25	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20131024_gnupg2_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-10-25	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1459.nasl - Type : ACT_GATHER_INFO
2013-10-25	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1458.nasl - Type : ACT_GATHER_INFO
2013-10-25	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2013-1458.nasl - Type : ACT_GATHER_INFO
2013-10-25	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-1459.nasl - Type : ACT_GATHER_INFO
2013-10-15	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2013-287-02.nasl - Type : ACT_GATHER_INFO
2013-10-15	Name : The remote Fedora host is missing a security update. File : fedora_2013-18866.nasl - Type : ACT_GATHER_INFO
2013-10-15	Name : The remote Fedora host is missing a security update. File : fedora_2013-18807.nasl - Type : ACT_GATHER_INFO
2013-10-15	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2013-287-01.nasl - Type : ACT_GATHER_INFO
2013-10-13	Name : The remote Fedora host is missing a security update. File : fedora_2013-18676.nasl - Type : ACT_GATHER_INFO
2013-10-11	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-247.nasl - Type : ACT_GATHER_INFO
2013-10-11	Name : The remote Fedora host is missing a security update. File : fedora_2013-18543.nasl - Type : ACT_GATHER_INFO
2013-10-11	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2774.nasl - Type : ACT_GATHER_INFO
2013-10-11	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2773.nasl - Type : ACT_GATHER_INFO
2013-10-10	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1987-1.nasl - Type : ACT_GATHER_INFO
2013-10-06	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_749b55872da111e3b1a9b499baab0cbe.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725433
http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000333.html
http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000334.html
http://lists.opensuse.org/opensuse-updates/2013-10/msg00020.html
http://lists.opensuse.org/opensuse-updates/2013-10/msg00025.html
http://rhn.redhat.com/errata/RHSA-2013-1459.html
http://www.debian.org/security/2013/dsa-2773
http://www.debian.org/security/2013/dsa-2774
http://www.ubuntu.com/usn/USN-1987-1
https://bugzilla.redhat.com/show_bug.cgi?id=1015685

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 12:36:20	Multiple Updates
2021-05-04 12:27:18	Multiple Updates
2021-04-22 01:33:04	Multiple Updates
2020-05-23 00:38:01	Multiple Updates
2016-04-26 23:33:08	Multiple Updates
2016-02-23 13:26:54	Multiple Updates
2015-01-21 13:26:22	Multiple Updates
2014-06-14 13:36:06	Multiple Updates
2014-02-23 13:21:07	Multiple Updates
2014-02-17 11:22:09	Multiple Updates
2014-01-04 13:19:36	Multiple Updates
2013-12-31 13:19:34	Multiple Updates
2013-12-05 17:20:46	Multiple Updates
2013-12-01 13:19:11	Multiple Updates
2013-10-29 21:20:03	Multiple Updates
2013-10-29 13:19:09	First insertion

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	11
CPE ID(s)	29
Sources(s)	10
Nessus® Exploit(s)	28

	Related
5.8	USN-1987-1
5.8	RHSA-2013:1459
5.8	RHSA-2013:1458
5.8	MDVSA-2013:247
5.8	GLSA-201402-24
5.8	DSA-2774
5.8	DSA-2773
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 7 more Alert(s)

5 - CVE-2013-4402

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU