[ MDVSA-2013:247 ] gnupg

2013-10-12T00:00:00
ID SECURITYVULNS:DOC:29930
Type securityvulns
Reporter Securityvulns
Modified 2013-10-12T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2013:247 http://www.mandriva.com/en/support/security/


Package : gnupg Date : October 10, 2013 Affected: Business Server 1.0, Enterprise Server 5.0


Problem Description:

Multiple vulnerabilities has been discovered and corrected in gnupg:

GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey (CVE-2013-4351).

Special crafted input data may be used to cause a denial of service against GPG. GPG can be forced to recursively parse certain parts of OpenPGP messages ad infinitum (CVE-2013-4402).

The updated packages have been patched to correct this issue.


References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4351 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4402 http://advisories.mageia.org/MGASA-2013-0299.html http://advisories.mageia.org/MGASA-2013-0303.html http://lists.gnu.org/archive/html/info-gnu/2013-10/msg00002.html http://lists.gnu.org/archive/html/info-gnu/2013-10/msg00003.html


Updated Packages:

Mandriva Enterprise Server 5: fbd115f23ec4f6a05582ae80e49e7645 mes5/i586/gnupg-1.4.9-5.3mdvmes5.2.i586.rpm 6acd4c8754851b6538b65b0e47b0b713 mes5/i586/gnupg2-2.0.9-3.3mdvmes5.2.i586.rpm 241f14f857ac10bcdb27d85dada891dd mes5/SRPMS/gnupg-1.4.9-5.3mdvmes5.2.src.rpm 57f10f15a3dabba96af7a0056536613b mes5/SRPMS/gnupg2-2.0.9-3.3mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64: 89b1885f005f3eaf6b0f9d11fb787554 mes5/x86_64/gnupg-1.4.9-5.3mdvmes5.2.x86_64.rpm e8066bcd0cfcab70000adc18598854f9 mes5/x86_64/gnupg2-2.0.9-3.3mdvmes5.2.x86_64.rpm 241f14f857ac10bcdb27d85dada891dd mes5/SRPMS/gnupg-1.4.9-5.3mdvmes5.2.src.rpm 57f10f15a3dabba96af7a0056536613b mes5/SRPMS/gnupg2-2.0.9-3.3mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64: 284ac6d2ad095ce979df482fa99d210a mbs1/x86_64/gnupg-1.4.12-3.2.mbs1.x86_64.rpm a118676f072c0a52988f2aeec6bf86af mbs1/x86_64/gnupg2-2.0.18-3.2.mbs1.x86_64.rpm 8e07611a9d7e2d7ab16d01a6a9d4090b mbs1/SRPMS/gnupg-1.4.12-3.2.mbs1.src.rpm db92e694092193f98dc2fd43fe6c3912 mbs1/SRPMS/gnupg2-2.0.18-3.2.mbs1.src.rpm


To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com


Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSVnYCmqjQ0CJFipgRArb0AKDO1x51xpdkXHmgOiOxjw6ei5SLAACZAVJZ Dry2GuDwPgRZX3xGrxTWbFU= =s4km -----END PGP SIGNATURE-----