[USN-432-1] GnuPG vulnerability

Kees Cook kees at ubuntu.com
Thu Mar 8 07:04:49 UTC 2007 

=========================================================== 
Ubuntu Security Notice USN-432-1             March 08, 2007
gnupg vulnerability
CVE-2007-1263
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.10
Ubuntu 6.06 LTS
Ubuntu 6.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 5.10:
  gnupg                                    1.4.1-1ubuntu1.7

Ubuntu 6.06 LTS:
  gnupg                                    1.4.2.2-1ubuntu2.5

Ubuntu 6.10:
  gnupg                                    1.4.3-2ubuntu3.3

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Gerardo Richarte from Core Security Technologies discovered that when 
gnupg is used without --status-fd, there is no way to distinguish 
initial unsigned messages from a following signed message.  An attacker 
could inject an unsigned message, which could fool the user into 
thinking the message was entirely signed by the original sender.


Updated packages for Ubuntu 5.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7.diff.gz
      Size/MD5:    25425 95c70d62c7e93b0a294250f1ef8bffbc
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7.dsc
      Size/MD5:      684 80528a24f59f9dc0063a6640d49d2879
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1.orig.tar.gz
      Size/MD5:  4059170 1cc77c6943baaa711222e954bbd785e5

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7_amd64.deb
      Size/MD5:  1136974 ab221f5e755ffcb88f9db8be00d2b78c
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ubuntu1.7_amd64.udeb
      Size/MD5:   152330 4babe71c8a3f93bcc1169dfc60e47b89

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7_i386.deb
      Size/MD5:  1045290 eeb54cf2e3b201b2c813507b537dae81
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ubuntu1.7_i386.udeb
      Size/MD5:   130812 86c1ee88f32bf5e4a35144d22e42024b

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7_powerpc.deb
      Size/MD5:  1120350 8c0a11b1b29093e2a6fc198d93bee8f0
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ubuntu1.7_powerpc.udeb
      Size/MD5:   140330 8bf6e199e1ed859d65f015f8f5a6fe05

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7_sparc.deb
      Size/MD5:  1065120 25a911b1644da3be8880221f002f8563
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ubuntu1.7_sparc.udeb
      Size/MD5:   139740 80e9a3c9748f918745c5417ea64ce06a

Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5.diff.gz
      Size/MD5:    24318 aa78ecc4d9dd51b8d4084e152093e6be
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5.dsc
      Size/MD5:      690 460f793de7cea304ac0e038bf4e8f348
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2.orig.tar.gz
      Size/MD5:  4222685 50d8fd9c5715ff78b7db0e5f20d08550

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5_amd64.deb
      Size/MD5:  1066892 bebab8ec7afe738b426e080f10af9c37
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1ubuntu2.5_amd64.udeb
      Size/MD5:   140414 8b9f2ca68439062984c4314ba5c0e2d8

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5_i386.deb
      Size/MD5:   981952 bd95db0369ba517b3f29ec132676fcc5
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1ubuntu2.5_i386.udeb
      Size/MD5:   120392 188d1f1cb3ec385c444e623d9efcadde

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5_powerpc.deb
      Size/MD5:  1054420 0da3379c332cb3786933861ec66c9478
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1ubuntu2.5_powerpc.udeb
      Size/MD5:   130262 c528d3f517f94a50ecd06a10b5767c84

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5_sparc.deb
      Size/MD5:   994884 159220ec1a5c667a073e13e63380fd49
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1ubuntu2.5_sparc.udeb
      Size/MD5:   127548 755511f26f78dd7744434601d684404b

Updated packages for Ubuntu 6.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3.diff.gz
      Size/MD5:    29804 2f3b7d22a447212c871a1ca6ff754df7
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3.dsc
      Size/MD5:      697 54eb12ebf5f4426abe78eb286c32ec35
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3.orig.tar.gz
      Size/MD5:  4320394 fcdf572a33dd037653707b128dd150a7

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.3-2ubuntu3.3_amd64.udeb
      Size/MD5:   380186 ac0b24986f64b7be4da102509f86ea27
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3_amd64.deb
      Size/MD5:  1112634 339bb8b52507096e2a1f9cb75864629f
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ubuntu3.3_amd64.udeb
      Size/MD5:   142772 a460f38f4669944e3c8cdbff531b4a41

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.3-2ubuntu3.3_i386.udeb
      Size/MD5:   357730 08dee030fef6b31ba21b92d56b134cad
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3_i386.deb
      Size/MD5:  1056104 826246d40bdd92c0b04a0c0d385e4a64
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ubuntu3.3_i386.udeb
      Size/MD5:   129176 8d173c26de67072948c7f34dfceb75ae

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.3-2ubuntu3.3_powerpc.udeb
      Size/MD5:   372730 c3dd8be3260d14e82a4af95f37c6616d
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3_powerpc.deb
      Size/MD5:  1107684 1a8a6be788ab4afd0c33483f5faa6a1f
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ubuntu3.3_powerpc.udeb
      Size/MD5:   136440 ee71f2b32e7e085488e134ba68f89122

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.3-2ubuntu3.3_sparc.udeb
      Size/MD5:   366290 90570b1dafeb0a01862c5768579564a3
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3_sparc.deb
      Size/MD5:  1042784 e8b19dfe7705afbde9c54b223e44dcba
    http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ubuntu3.3_sparc.udeb
      Size/MD5:   132868 edc923da480a84aa4d060c8d7be58be2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20070307/86cd408c/attachment.sig>

More information about the ubuntu-security-announce mailing list