Executive Summary
| Summary | |
|---|---|
| Title | gnupg vulnerability |
| Informations | |||
|---|---|---|---|
| Name | USN-252-1 | First vendor Publication | 2006-02-17 |
| Vendor | Ubuntu | Last vendor Modification | 2006-02-17 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.6 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) Ubuntu 5.10 (Breezy Badger) The following packages are affected: gnupg The problem can be corrected by upgrading the affected package to version 1.2.4-4ubuntu2.2 (for ubuntu 4.10), 1.2.5-3ubuntu5.2 (for Ubuntu 5.04), or 1.4.1-1ubuntu1.1 (for Ubuntu 5.10). In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Tavis Ormandy discovered a potential weakness in the signature verification of gnupg. gpgv and gpg --verify returned a successful exit code even if the checked file did not have any signature at all. The recommended way of checking the result is to evaluate the status messages, but some third party applications might just check the exit code for determining whether or not a signature is valid. These applications could be tricked into erroneously reporting a valid signature. Please note that this does not affect the Ubuntu package signature checks. |
Original Source
| Url : http://www.ubuntu.com/usn/USN-252-1 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10084 | |||
| Oval ID: | oval:org.mitre.oval:def:10084 | ||
| Title: | gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify". | ||
| Description: | gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify". | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-0455 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for gpg File : nvt/sles9p5019083.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200602-10 (gnupg) File : nvt/glsa_200602_10.nasl |
| 2008-09-04 | Name : FreeBSD Ports: gnupg File : nvt/freebsd_gnupg1.nasl |
| 2008-09-04 | Name : FreeBSD Ports: gnupg File : nvt/freebsd_gnupg2.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 978-1 (gnupg) File : nvt/deb_978_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2006-072-02 gnupg File : nvt/esoft_slk_ssa_2006_072_02.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 23221 | GnuPG gpgv Detached Signature Verification Failure |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-978.nasl - Type : ACT_GATHER_INFO |
| 2006-07-05 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2006-0266.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_63fe41899f9711daac320001020eed82.nasl - Type : ACT_GATHER_INFO |
| 2006-03-18 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2006-055.nasl - Type : ACT_GATHER_INFO |
| 2006-03-16 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2006-0266.nasl - Type : ACT_GATHER_INFO |
| 2006-03-14 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-072-02.nasl - Type : ACT_GATHER_INFO |
| 2006-03-13 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-252-1.nasl - Type : ACT_GATHER_INFO |
| 2006-02-22 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_009.nasl - Type : ACT_GATHER_INFO |
| 2006-02-19 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-116.nasl - Type : ACT_GATHER_INFO |
| 2006-02-19 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200602-10.nasl - Type : ACT_GATHER_INFO |
| 2006-02-19 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2006-043.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:03:18 |
|
