Bug 618156 (CVE-2010-2547) - CVE-2010-2547 GnuPG 2: use-after-free when importing certificate with many alternate names
Summary: CVE-2010-2547 GnuPG 2: use-after-free when importing certificate with many al...
Alias: CVE-2010-2547
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 617706 618163 619435 619436 833905
TreeView+ depends on / blocked
Reported: 2010-07-26 09:51 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:38 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2013-04-11 20:23:51 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0603 0 normal SHIPPED_LIVE Moderate: gnupg2 security update 2010-08-04 21:42:19 UTC

Description Jan Lieskovsky 2010-07-26 09:51:57 UTC
A use after free flaw was found in the way GnuPG 2.0 verified signature
and / or imported a certificate with many Subject Alternate Names. A remote
attacker could provide a specially-crafted certificate file and trick the
local user into verifying / importing it, which could lead to arbitrary
code execution with the privileges of the user running the gpgsm executable.

  [1] http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.html
  [2] http://bugs.gentoo.org/show_bug.cgi?id=329587
  [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590122

CVE Request:
  [4] http://www.openwall.com/lists/oss-security/2010/07/23/4

Affected versions (from [1]):
  * The bug exists in all versions of GnuPG including the recently
    released GnuPG 2.0.16.

  * GPG (i.e. OpenPGP) is NOT affected.

  * GnuPG 1.x is NOT affected because it does not come with
    the GPGSM tool.

Upstream patch (from [1], 'Solution part'):

Apply the following patch.  The patch is required for all GnuPG
versions < 2.0.17.  It applies to 2.0.16 but should apply to many
older versions as well.

--- kbx/keybox-blob.c   (revision 5367)
+++ kbx/keybox-blob.c   (working copy)
@@ -898,6 +898,7 @@
               rc = gpg_error_from_syserror ();
               goto leave;
+          names = tmp;
       names[blob->nuids++] = p;
       if (!i && (p=x509_email_kludge (p)))

Comment 1 Jan Lieskovsky 2010-07-26 10:11:19 UTC
This issue did NOT affect the versions of the gnupg package, as shipped
with Red Hat Enterprise Linux 3, 4, and 5, as they did not include
the GPGSM tool.

This issue affects the version of the gnupg v2.0 package, as shipped
with Red Hat Enterprise Linux 5.

This issue has been already addressed in the current versions of
the gnupg2.0 package, as present in Fedora -testing repository
(gnupg2-2.0.13-2.fc12, gnupg2-2.0.14-4.fc13).

Comment 5 Fedora Update System 2010-08-03 00:46:18 UTC
gnupg2-2.0.14-4.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 errata-xmlrpc 2010-08-04 21:42:22 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0603 https://rhn.redhat.com/errata/RHSA-2010-0603.html

Note You need to log in before you can comment on or make changes to this bug.