oss-security - Re: CVE request: GnuPG Import Key Memory Corruption

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Thu, 27 Mar 2008 18:39:16 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Robert Buchholz <rbu@...too.org>
Subject: Re: CVE request: GnuPG Import Key Memory Corruption


======================================================
Name: CVE-2008-1530
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1530
Reference: MISC:http://www.ocert.org/advisories/ocert-2008-1.html
Reference: CONFIRM:https://bugs.g10code.com/gnupg/issue894
Reference: CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=214990

GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial
of service (crash) and possibly execute arbitrary code via crafted
duplicate keys that are imported from key servers, which triggers
"memory corruption around deduplication of user IDs."

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.