Lucene search
UbuntuUSN-264-1HistoryApr 04, 2006 - 12:00 a.m.
gnupg vulnerability
2006-04-0400:00:00
ubuntu.com
24
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
AI Score
6.1
Confidence
Low
EPSS
0.006
Percentile
78.5%
Releases
- Ubuntu 5.10
- Ubuntu 5.04
- Ubuntu 4.10
Details
Tavis Ormandy discovered a flaw in gnupg’s signature verification. In
some cases, certain invalid signature formats could cause gpg to
report a ‘good signature’ result for auxiliary unsigned data which was
prepended or appended to the checked message part.
References
Related
debian
debian
[SECURITY] [DSA 993-2] New GnuPG packages fix broken signature check
2006-03-13 13:16:52
[SECURITY] [DSA 993-2] New GnuPG packages fix broken signature check
2006-03-13 13:16:52
[SECURITY] [DSA 993-1] New GnuPG packages fix broken signature check
2006-03-10 20:37:25
nessus
nessus
SUSE-SA:2006:014: gpg
2006-03-17 00:00:00
Fedora Core 4 : gnupg-1.4.2.2-1 (2006-147)
2006-03-14 00:00:00
GLSA-200603-08 : GnuPG: Incorrect signature verification
2006-03-13 00:00:00
openvas
openvas
SLES9: Security update for gpg
2009-10-10 00:00:00
Gentoo Security Advisory GLSA 200603-08 (gnupg)
2008-09-24 00:00:00
SLES9: Security update for gpg
2009-10-10 00:00:00
securityvulns
securityvulns
GnuPG does not detect injection of unsigned data
2006-03-10 00:00:00
freebsd
freebsd
GnuPG does not detect injection of unsigned data
2006-03-09 00:00:00
gentoo
gentoo
GnuPG: Incorrect signature verification
2006-03-10 00:00:00
cve
cve
CVE-2006-0049
2006-03-13 21:06:00
ubuntucve
ubuntucve
CVE-2006-0049
2006-03-13 00:00:00
centos
centos
gnupg security update
2006-03-21 22:54:57
gnupg security update
2006-03-16 00:53:16
slackware
slackware
[slackware-security] gnupg
2006-03-14 04:59:29
redhat
redhat
(RHSA-2006:0266) gnupg security update
2006-03-15 00:00:00
nvd
nvd
CVE-2006-0049
2006-03-13 21:06:00
debiancve
debiancve
CVE-2006-0049
2006-03-13 21:06:00
prion
prion
Code injection
2006-03-13 21:06:00
cvelist
cvelist
CVE-2006-0049
2006-03-13 21:00:00
suse
suse
remote code execution in gpg
2006-03-10 17:18:31
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
AI Score
6.1
Confidence
Low
EPSS
0.006
Percentile
78.5%
Related for USN-264-1