[security-alerts] FW: [SA19173] GnuPG Unsigned Data Injection Detection Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> GnuPG Unsigned Data Injection Detection Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA19173
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/19173/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> Security Bypass
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> GnuPG / gpg 1.0.x
> http://secunia.com/product/2573/
> GnuPG / gpg 1.2.x
> http://secunia.com/product/309/
> GnuPG / gpg 1.3.x
> http://secunia.com/product/2591/
> GnuPG / gpg 1.4.x
> http://secunia.com/product/8087/
> 
> DESCRIPTION:
> A vulnerability has been reported in GnuPG, which can be exploited by
> malicious people to bypass certain security restrictions.
> 
> The vulnerability is caused due to an error in the detection of
> unsigned data. This makes it possible to inject arbitrary data into a
> signed message and affects the verification of non-detached signatures
> and signatures embedded in encrypted messages.
> 
> The vulnerability affects all versions prior to 1.4.2.2. Version
> 1.9.x (development branch) is not affected unless the deprecated gpg
> part has been enabled.
> 
> SOLUTION:
> Update to version 1.4.2.2 or later.
> http://www.gnupg.org/download/
> 
> PROVIDED AND/OR DISCOVERED BY:
> The vendor credits Tavis Ormandy.
> 
> ORIGINAL ADVISORY:
> http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html
>