Vulnerability CVE-2007-1263

Vulnerability CVE-2007-1263

Published: 2007-03-06 Modified: 2012-02-12

Description:

GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.

See advisories in our WLB2 database:

	Topic	Author	Date
Med.	GnuPG and GnuPG clients unsigned data injection vulnerability	CORE Security Te...	09.03.2007

Type:

CWE-Other

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
5/10	2.9/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Gnupg -> Gnupg
GNU -> Gpgme

References:

ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc

http://fedoranews.org/cms/node/2775

http://fedoranews.org/cms/node/2776

http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html

http://lists.suse.com/archive/suse-security-announce/2007-Mar/0008.html

http://securityreason.com/securityalert/2353

http://support.avaya.com/elmodocs2/security/ASA-2007-144.htm

http://www.coresecurity.com/?action=item&id=1687

http://www.debian.org/security/2007/dsa-1266

http://www.mandriva.com/security/advisories?name=MDKSA-2007:059

http://www.redhat.com/support/errata/RHSA-2007-0106.html

http://www.redhat.com/support/errata/RHSA-2007-0107.html

http://www.securityfocus.com/archive/1/461958/100/0/threaded

http://www.securityfocus.com/archive/1/461958/30/7710/threaded

http://www.securityfocus.com/bid/22757

http://www.securitytracker.com/id?1017727

http://www.trustix.org/errata/2007/0009/

http://www.ubuntu.com/usn/usn-432-1

http://www.ubuntu.com/usn/usn-432-2

http://www.vupen.com/english/advisories/2007/0835

https://issues.rpath.com/browse/RPL-1111

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10496

Vulnerability CVE-2007-1263

GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.

See advisories in our WLB2 database:

Med.

GnuPG and GnuPG clients unsigned data injection vulnerability

CWE-Other

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:N)

5/10

2.9/10

10/10

Remote

Low

No required

None

Partial

None

Affected software

References: