Description:
A vulnerability has been reported in GnuPG, which can potentially be exploited to compromise a vulnerable system.
The vulnerability is caused due to an error when importing keys with
duplicated IDs. This can be exploited to cause a memory corruption when
importing keys via --refresh-keys or --import.
Successful exploitation potentially allows execution of arbitrary code, but has not been proven yet.
The vulnerability is reported in version 1.4.8 and 2.0.8. Prior versions may also be affected.
Solution:
Update to version 1.4.9 or 2.0.9.
ftp://ftp.gnupg.org/gcrypt/gnupg
Provided and/or discovered by:
Andrea Barisani, oCERT
Original Advisory:
http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html
https://bugs.g10code.com/gnupg/issue894
oCERT:
http://www.ocert.org/advisories/ocert-2008-1.html |
