GnuPG format string vulnerability in do_get() in ttyio.c while prompting for a new filename

2001-12-10T00:00:00
ID VU:403051
Type cert
Reporter CERT
Modified 2003-11-05T00:00:00

Description

Overview

There is a format string vulnerability in GNU Privacy Guard. By sending a GPG message with a carefully crafted malicious filename, an attacker may be able to execute arbitrary code as the user who decrypts the message.

Description

GNU Privacy Guard (GPG) is a free, RFC2440 compliant replacement for Pretty Good Privacy (PGP).

A format string vulnerability occurs in the do_get() function in ttyio.c, where GnuPG calls tty_printf() with a user supplied format string. When GPG encounters a filename with an unknown suffix, and it is not in batch mode, it prompts the user for a new filename to write the decrypted results to. The default value (which is included in the prompt) is the existing filename. Note that the filename is embedded in the encrypted message itself, and that safe file names selected by the recipient is not sufficient to protect against this attack. If the filename embedded in the message contains printf style format characters, the message creator may be able to execute arbitrary code as the user who decrypts the message.


Impact

An attacker may be able to execute arbitrary code as the user decrypting the message.


Solution

Apply a patch from your vendor

GNU Privacy Guard version 1.0.6 corrects this problem. Many vendors have published security advisories and released updated distributions correcting the vulnerability.


Decrypt files in batch mode

Because the vulnerable code is not called when GnuPG is in batch mode, users may be able to work around the vulnerability by specifying --batch on the command line.


Systems Affected

Vendor| Status| Date Notified| Date Updated
---|---|---|---
Conectiva| | -| 12 Dec 2001
Debian| | 10 Dec 2001| 11 Dec 2001
FreeBSD| | 10 Dec 2001| 11 Dec 2001
Guardian Digital Inc. | | -| 05 Nov 2003
Immunix| | -| 10 Dec 2001
MandrakeSoft| | 10 Dec 2001| 11 Dec 2001
Red Hat Inc.| | 10 Dec 2001| 11 Dec 2001
SuSE Inc.| | -| 10 Dec 2001
The SCO Group (SCO Linux)| | 10 Dec 2001| 11 Dec 2001
Trustix| | -| 10 Dec 2001
TurboLinux| | -| 05 Nov 2003
Fujitsu| | 10 Dec 2001| 05 Nov 2003
OpenBSD| | 10 Dec 2001| 05 Nov 2003
Apple Computer Inc.| | 10 Dec 2001| 11 Dec 2001
BSDI| | 10 Dec 2001| 11 Dec 2001
If you are a vendor and your product is affected, let us know.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | N/A | N/A

References

  • <http://www.gnupg.org/whatsnew.html#rn20010529>
  • <http://www.securityfocus.com/bid/2797>
  • <http://www.securityfocus.com/archive/1/187352>
  • <http://www.i.cz/en/onas/tisk4.html>
  • <http://linuxtoday.com/news_story.php3?ltsn=2001-05-30-015-20-SC-PD>
  • <http://www.redhat.com/support/errata/RHSA-2001-073.html>
  • <http://lists.suse.com/archive/suse-security-announce/2001-Jun/0000.html>
  • <http://www.turbolinux.com/pipermail/tl-security-announce/2001-June/000439.html>
  • <http://www.mandrakesecure.net/en/advisories/2001/MDKSA-2001-053-1.php3?dis=8.1>
  • <http://lists.debian.org/debian-security-announce/debian-security-announce-2001/msg00064.html>
  • <http://www.caldera.com/support/security/advisories/CSSA-2001-020.1.txt>
  • <http://www.trustix.org/pipermail/tsl-announce/2001-June/000011.html>
  • <http://xforce.iss.net/static/6642.php>

Credit

Thanks to Fish Stiqz for discovering this vulnerability.

This document was written by Cory F. Cohen.

Other Information

  • CVE IDs: CVE-2001-0522
  • Date Public: 29 May 2001
  • Date First Published: 10 Dec 2001
  • Date Last Updated: 05 Nov 2003
  • Severity Metric: 21.94
  • Document Revision: 9