CVE-2006-0049
published 2006-03-13CVE-2006-0049: gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not…
PriorityP419medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
2.37%
81.9th percentile
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gnupg2 | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
| gnu | privacy_guard | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
gnupg vulnerability
vendor_ubuntu·2006-04-04
CVE-2006-0049 gnupg vulnerability
Title: gnupg vulnerability
Summary: gnupg vulnerability
Tavis Ormandy discovered a flaw in gnupg's signature verification. In
some cases, certain invalid signature formats could cause gpg to
report a 'good signature' result for auxiliary unsigned data which was
prepended or appended to the checked message part.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
security flaw
vendor_redhat·2006-03-09·CVSS 5.0
CVE-2006-0049 [MEDIUM] security flaw
security flaw
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
Debian
CVE-2006-0049: gnupg2 - gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, wh...
vendor_debian·2006·CVSS 5.0
CVE-2006-0049 [MEDIUM] CVE-2006-0049: gnupg2 - gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, wh...
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-c5p7-4hq8-gm4c: gpg in GnuPG before 1
ghsa_unreviewed·2022-05-03·CVSS 4.6
CVE-2006-0049 [MEDIUM] GHSA-c5p7-4hq8-gm4c: gpg in GnuPG before 1
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-0049 security flaw
bugzilla·2018-08-16·CVSS 5.0
CVE-2006-0049 [MEDIUM] CVE-2006-0049 security flaw
CVE-2006-0049 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
Bugzilla
CVE-2006-0049 Gnupg incorrect malformed message verification
bugzilla·2006-03-13·CVSS 5.0
CVE-2006-0049 [MEDIUM] CVE-2006-0049 Gnupg incorrect malformed message verification
CVE-2006-0049 Gnupg incorrect malformed message verification
+++ This bug was initially created as a clone of Bug #184556 +++
Gnupg incorrect malformed message verification
Tavis Ormandy discovered that it is still possible to trick gnupg into
incorrectly verifying a signed message.
The patch is here:
ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.2.1-1.4.2.2.diff.bz2
This issue also affects RHEL3
This issue also affects RHEL2.1
-- Additional comment from [email protected] on 2006-03-13 09:56 EST --
Created an attachment (id=126039)
Demo reproducer
This reproducer was given to us by Gentoo.
In order to reproduce this issue on RHEL, the --ignore-crc-error option must be
given to gpg. This also mitigates the usefullness of this issue on RHEL.
Bugzilla
CVE-2006-0049, CVE-2006-0455 GnuPG signature verification bugs
bugzilla·2006-03-13·CVSS 5.0
CVE-2006-0049 [MEDIUM] CVE-2006-0049, CVE-2006-0455 GnuPG signature verification bugs
CVE-2006-0049, CVE-2006-0455 GnuPG signature verification bugs
From the official GnuPG advisory:
"Signature verification of non-detached signatures may give a positive result
but when extracting the signed data, this data may be prepended or appended with
extra data not covered by the signature. Thus it is possible for an attacker to
take any signed message and inject extra arbitrary data."
All versions :
"What does this discovery mean to OpenPGP users?
"If you use an OpenPGP-based program such as PGP® solutions, Gnu Privacy Guard,
or Hushmail to encrypt and decrypt emails or files, Mister's and Zuccherato's
discovery does not affect you. ...
"We know of no real-world application that is affected by this type of attack.
It is an attack that requires the active participation of someon
Bugzilla
CVE-2006-0049 Gnupg incorrect malformed message verification
bugzilla·2006-03-10·CVSS 5.0
CVE-2006-0049 [MEDIUM] CVE-2006-0049 Gnupg incorrect malformed message verification
CVE-2006-0049 Gnupg incorrect malformed message verification
+++ This bug was initially created as a clone of Bug #184557 +++
Gnupg incorrect malformed message verification
Tavis Ormandy discovered that it is still possible to trick gnupg into
incorrectly verifying a signed message.
The patch is here:
ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.2.1-1.4.2.2.diff.bz2
Bugzilla
CVE-2006-0049 Gnupg incorrect malformed message verification
bugzilla·2006-03-09·CVSS 5.0
CVE-2006-0049 [MEDIUM] CVE-2006-0049 Gnupg incorrect malformed message verification
CVE-2006-0049 Gnupg incorrect malformed message verification
Gnupg incorrect malformed message verification
Tavis Ormandy discovered that it is still possible to trick gnupg into
incorrectly verifying a signed message.
The patch is here:
ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.2.1-1.4.2.2.diff.bz2
Discussion:
From User-Agent: XML-RPC
gnupg-1.4.2.2-1 has been pushed for FC4, which should resolve this issue. If these problems are still present in this version, then please make note of it in this bug report.
---
Hmm, don't know why this didn't get closed.
Bugzilla
CVE-2006-0049 Gnupg incorrect malformed message verification
bugzilla·2006-03-09·CVSS 5.0
CVE-2006-0049 [MEDIUM] CVE-2006-0049 Gnupg incorrect malformed message verification
CVE-2006-0049 Gnupg incorrect malformed message verification
Gnupg incorrect malformed message verification
Tavis Ormandy discovered that it is still possible to trick gnupg into
incorrectly verifying a signed message.
The patch is here:
ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.2.1-1.4.2.2.diff.bz2
This issue also affects RHEL3
This issue also affects RHEL2.1
Discussion:
Created attachment 126039
Demo reproducer
This reproducer was given to us by Gentoo.
In order to reproduce this issue on RHEL, the --ignore-crc-error option must be
given to gpg. This also mitigates the usefullness of this issue on RHEL.
---
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more informa
ftp://patches.sgi.com/support/free/security/advisories/20060401-01-Uhttp://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.htmlhttp://lists.suse.de/archive/suse-security-announce/2006-Mar/0003.htmlhttp://secunia.com/advisories/19173http://secunia.com/advisories/19197http://secunia.com/advisories/19203http://secunia.com/advisories/19231http://secunia.com/advisories/19232http://secunia.com/advisories/19234http://secunia.com/advisories/19244http://secunia.com/advisories/19249http://secunia.com/advisories/19287http://secunia.com/advisories/19532http://securityreason.com/securityalert/450http://securityreason.com/securityalert/568http://securitytracker.com/id?1015749http://www.debian.org/security/2006/dsa-993http://www.gentoo.org/security/en/glsa/glsa-200603-08.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:055http://www.osvdb.org/23790http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00021.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0266.htmlhttp://www.securityfocus.com/archive/1/427324/100/0/threadedhttp://www.securityfocus.com/archive/1/433931/100/0/threadedhttp://www.securityfocus.com/bid/17058http://www.slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.476477http://www.trustix.org/errata/2006/0014http://www.vupen.com/english/advisories/2006/0915https://exchange.xforce.ibmcloud.com/vulnerabilities/25184https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10063https://usn.ubuntu.com/264-1/ftp://patches.sgi.com/support/free/security/advisories/20060401-01-Uhttp://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.htmlhttp://lists.suse.de/archive/suse-security-announce/2006-Mar/0003.htmlhttp://secunia.com/advisories/19173http://secunia.com/advisories/19197http://secunia.com/advisories/19203http://secunia.com/advisories/19231http://secunia.com/advisories/19232http://secunia.com/advisories/19234http://secunia.com/advisories/19244http://secunia.com/advisories/19249http://secunia.com/advisories/19287http://secunia.com/advisories/19532http://securityreason.com/securityalert/450http://securityreason.com/securityalert/568http://securitytracker.com/id?1015749http://www.debian.org/security/2006/dsa-993http://www.gentoo.org/security/en/glsa/glsa-200603-08.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:055http://www.osvdb.org/23790http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00021.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0266.htmlhttp://www.securityfocus.com/archive/1/427324/100/0/threadedhttp://www.securityfocus.com/archive/1/433931/100/0/threadedhttp://www.securityfocus.com/bid/17058http://www.slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.476477http://www.trustix.org/errata/2006/0014http://www.vupen.com/english/advisories/2006/0915https://exchange.xforce.ibmcloud.com/vulnerabilities/25184https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10063https://usn.ubuntu.com/264-1/
2006-03-13
Published