A use after free flaw was found in the way GnuPG 2.0 verified signature and / or imported a certificate with many Subject Alternate Names. A remote attacker could provide a specially-crafted certificate file and trick the local user into verifying / importing it, which could lead to arbitrary code execution with the privileges of the user running the gpgsm executable. References: [1] http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.html [2] http://bugs.gentoo.org/show_bug.cgi?id=329587 [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590122 CVE Request: [4] http://www.openwall.com/lists/oss-security/2010/07/23/4 Affected versions (from [1]): * The bug exists in all versions of GnuPG including the recently released GnuPG 2.0.16. * GPG (i.e. OpenPGP) is NOT affected. * GnuPG 1.x is NOT affected because it does not come with the GPGSM tool. Upstream patch (from [1], 'Solution part'): Apply the following patch. The patch is required for all GnuPG versions < 2.0.17. It applies to 2.0.16 but should apply to many older versions as well. --- kbx/keybox-blob.c (revision 5367) +++ kbx/keybox-blob.c (working copy) @@ -898,6 +898,7 @@ rc = gpg_error_from_syserror (); goto leave; } + names = tmp; } names[blob->nuids++] = p; if (!i && (p=x509_email_kludge (p)))
This issue did NOT affect the versions of the gnupg package, as shipped with Red Hat Enterprise Linux 3, 4, and 5, as they did not include the GPGSM tool. This issue affects the version of the gnupg v2.0 package, as shipped with Red Hat Enterprise Linux 5. This issue has been already addressed in the current versions of the gnupg2.0 package, as present in Fedora -testing repository (gnupg2-2.0.13-2.fc12, gnupg2-2.0.14-4.fc13).
gnupg2-2.0.14-4.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2010:0603 https://rhn.redhat.com/errata/RHSA-2010-0603.html