Bug 185346 - CVE-2006-0049 Gnupg incorrect malformed message verification
Summary: CVE-2006-0049 Gnupg incorrect malformed message verification
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: gnupg
Version: 3.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nalin Dahyabhai
QA Contact: Mike McLean
URL:
Whiteboard: source=vendorsec,reported=20060305,pu...
Depends On: 184556
Blocks:
TreeView+ depends on / blocked
 
Reported: 2006-03-13 21:39 UTC by Nalin Dahyabhai
Modified: 2007-11-30 22:07 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2006-03-15 17:32:34 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Nalin Dahyabhai 2006-03-13 21:39:51 UTC 
+++ This bug was initially created as a clone of Bug #184556 +++

Gnupg incorrect malformed message verification

Tavis Ormandy discovered that it is still possible to trick gnupg into
incorrectly verifying a signed message.

The patch is here:
ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.2.1-1.4.2.2.diff.bz2


This issue also affects RHEL3
This issue also affects RHEL2.1

-- Additional comment from bressers on 2006-03-13 09:56 EST --
Created an attachment (id=126039)
Demo reproducer

This reproducer was given to us by Gentoo.

In order to reproduce this issue on RHEL, the --ignore-crc-error option must be
given to gpg.  This also mitigates the usefullness of this issue on RHEL.
Note You need to log in before you can comment on or make changes to this bug.