oss-security - Re: CVE request: GnuPG Import Key Memory Corruption

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 27 Mar 2008 18:39:16 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Robert Buchholz <rbu@...too.org>
cc: coley@...re.org, lcars@...rt.org, oss-security@...ts.openwall.com,
        wk@...pg.org
Subject: Re: CVE request: GnuPG Import Key Memory Corruption


======================================================
Name: CVE-2008-1530
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1530
Reference: MISC:http://www.ocert.org/advisories/ocert-2008-1.html
Reference: CONFIRM:https://bugs.g10code.com/gnupg/issue894
Reference: CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=214990

GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial
of service (crash) and possibly execute arbitrary code via crafted
duplicate keys that are imported from key servers, which triggers
"memory corruption around deduplication of user IDs."

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.