Alert GCSA-06112 - Vulnerabilita' in GnuPG

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

     Alert ID : GCSA-06112
         Data : 14 dicembre 2006
       Titolo : Vulnerabilita' in GnuPG

******************************************************************


:: Descrizione del problema:

    Sono state individuate due vulnerabilita' in GnuPG:

    1. heap-based buffer overflow in make_printable_string() function.
    Inducendo l'utente a lanciare gpg in modalita' interattiva,
    su un messaggio  opportunamente costruito, un aggressore
    potrebbe riuscire ad eseguire codice arbitrario.
    Questa vulnerabilita' non e' sfruttabile quando gpg viene eseguito
    in modalita' batch.

    2. GnuPG OpenPGP packet processing function pointer overwrite.
    Questa vulnerabilita' puo' consentire ad un aggressore
    di eseguire codice arbitrario attraverso un pacchetto OpenPGP
    specificatamente costruito per sovrascrivere un puntatore a funzione.
    Questo bug e' sfruttabile remotamente.


:: Software interessato:

    GnuPG GNU Privacy Guard 1.4.5 e precedenti
    GnuPG GNU Privacy Guard 2.0.0 e precedenti

    Gpg4win 1.0.7
    RedHat Enterprise Linux 4 e precedenti
    RedHat Desktop 4.0
    Slackware Linux 11.0, 10.x, 9.x
    MandrakeSoft Linux Mandrake 2007.0
    S.u.S.E. Linux 10.1 e precedenti
    Debian Linux 3.1
    Ubuntu Linux versione 6.10, 6.06 LTS, 5.10 e precedenti


:: Impatto:

    Esecuzione di codice arbitrario.
    Denial of Service.


:: Soluzioni:

    Aggiornare il prodotto alla versione 1.4.6:

    http://www.gnupg.org/download/

    Sono disponibili anche delle patch per le versioni 2.0.1 e 1.4.5


:: Riferimenti:

    GnuPG [Announce]
    http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html
    http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html

    Mitre's CVE ID:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6169
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6235

    SecurityFocus Bugtraq ID:
    http://www.securityfocus.com/bid/21306
    http://www.securityfocus.com/bid/21462
    http://www.securityfocus.com/archive/1/453664

    CIAC Advisory
    http://www.ciac.org/ciac/bulletins/r-064.shtml

    Secunia advisories
    http://secunia.com/advisories/23094
    http://secunia.com/advisories/23245

    FrSIRT
    http://www.frsirt.com/english/advisories/2006/4736

    ISS X-Force
    http://xforce.iss.net/xforce/xfdb/30550
    http://xforce.iss.net/xforce/xfdb/30711

    OpenPKG Security Advisory
    http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html

    Red Hat Security Advisory
    http://www.redhat.com/support/errata/RHSA-2006-0754.html

    Mandriva Linux OS Advisory
    http://www.mandriva.com/security/advisories?name=MDKSA-2006:221

    Debian Security Advisory
    http://www.debian.org/security/2006/dsa-1231

    Ubuntu Security Notice
    http://www.ubuntu.com/usn/usn-389-1
    http://www.ubuntu.com/usn/usn-393-1
    http://www.ubuntu.com/usn/usn-393-2

    OpenPKG Security Advisory
    http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html


-----BEGIN PGP SIGNATURE-----

iQCVAwUBRYE25fOB+SpikaiRAQIqDwP8D6mvlgwSqiW4bXXKDzefXXqhTqRQK5D4
Dc5zqmeommMHiHIH9lP8sPMnJo8HvTLcLiKQZ03VASqUWfv2ecQTGKdHGFQlSOeL
pIauaz9t7swQYbV0FT197RshlV16ejf7kJu/uQ1r++79g9Oz20uUtKUm69nrZjt5
xyq7xHhVhzY=
=otMg
-----END PGP SIGNATURE-----