Vulnerability Note VU#427009

GnuPG vulnerable to remote data control

Original Release date: 18 Dec 2006 | Last revised: 06 Feb 2007

Overview

A vulnerability in GnuPG could allow a remote attacker to execute arbitrary code on an affected system.

Description

GNU Privacy Guard (GnuPG) is the GNU project's implementation of the OpenPGP standard as defined by RFC2440.

OpenPGP messages are processed by GnuPG using data structures called filters that are used in a way similar to pipelines in the shell. Context structures that are usually allocated on the stack and passed to the filter functions are used for communications between these filters. Before the context structure gets deallocated, the OpenPGP data stream that is fed into the filters is closed. In some cases, while decrypting encrypted packets, this may not happen and the filter may use a void context structure filled with garbage that is under the attacker's control. Another context is included in the filter context for use by the low-level decryption. The decryption algorithm is accessed by this context via a function pointer.

According to GnuPG:

    Using malformed OpenPGP packets an attacker is able to modify and dereference a function pointer in GnuPG.
The GnuPG advisory notes that both encrypted and signed data could be used as attack vectors for this vulnerability.

Impact

A remote, unauthenticated attacker with the ability to supply specially crafted OpenPGP packets to a vulnerable version of GnuPG may be able to execute arbitrary code on an affected system. The attacker-supplied code would be executed with the privileges of the user or application invoking gpg.

Solution

Apply a patch or upgrade

Patches have been released to address this issue. Please see the Systems Affected section of this document for more details on specific vendors.

Users who compile GnuPG from the original distribution are encouraged to upgrade to version 1.4.6 (or later) or apply the patch to upgrade from 1.4.5 to 1.4.6.


Run with limited privileges

Running GnuPG with reduced privileges may help mitigate the effects of this vulnerability. Note that this workaround will not prevent exploitation.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Debian GNU/LinuxAffected18 Dec 200621 Dec 2006
Gentoo LinuxAffected18 Dec 200621 Dec 2006
GnuPGAffected07 Dec 200607 Dec 2006
Mandriva, Inc.Affected18 Dec 200618 Dec 2006
OpenPKGAffected-21 Dec 2006
Openwall GNU/*/LinuxAffected18 Dec 200618 Dec 2006
Red Hat, Inc.Affected-07 Dec 2006
rPathAffected-07 Dec 2006
Slackware Linux Inc.Affected-21 Dec 2006
SUSE LinuxAffected18 Dec 200619 Dec 2006
Trustix Secure LinuxAffected-11 Dec 2006
UbuntuAffected-07 Dec 2006
Apple Computer, Inc.Not Affected18 Dec 200618 Dec 2006
Sun Microsystems, Inc.Not Affected18 Dec 200621 Dec 2006
Conectiva Inc.Unknown18 Dec 200618 Dec 2006
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This issue was publicly reported by Werner Koch of the GnuPG project who, in turn, credits Tavis Ormandy of the Gentoo Security Team with its discovery.

This document was written by Chad R Dougherty and Chris Taschner.

Other Information

  • CVE IDs: CVE-2006-6235
  • Date Public: 06 Dec 2006
  • Date First Published: 18 Dec 2006
  • Date Last Updated: 06 Feb 2007
  • Severity Metric: 9.11
  • Document Revision: 42

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.