GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.

From Red Hat Security Advisory 2007:0107 :

Updated GnuPG packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Gerardo Richarte discovered that a number of applications that make use of GnuPG are prone to a vulnerability involving incorrect verification of signatures and encryption. An attacker could add arbitrary content to a signed message in such a way that a receiver of the message would not be able to distinguish between the properly signed parts of a message and the forged, unsigned, parts.
(CVE-2007-1263)

Whilst this is not a vulnerability in GnuPG itself, the GnuPG team have produced a patch to protect against messages with multiple plaintext packets. Users should update to these erratum packages which contain the backported patch for this issue.

Red Hat would like to thank Core Security Technologies for reporting this issue.

From Red Hat Security Advisory 2007:0106 :

Updated GnuPG packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Gerardo Richarte discovered that a number of applications that make use of GnuPG are prone to a vulnerability involving incorrect verification of signatures and encryption. An attacker could add arbitrary content to a signed message in such a way that a receiver of the message would not be able to distinguish between the properly signed parts of a message and the forged, unsigned, parts.
(CVE-2007-1263)

Whilst this is not a vulnerability in GnuPG itself, the GnuPG team have produced a patch to protect against messages with multiple plaintext packets. Users should update to these erratum packages which contain the backported patch for this issue.

Red Hat would like to thank Core Security Technologies for reporting this issue.

When printing a text stream with a GPG signature it was possible for an attacker to create a stream with 'unsigned text, signed text' where both unsigned and signed text would be shown without distinction which one was signed and which part wasn't.

This is tracked by the Mitre CVE ID CVE-2007-1263.

The update introduces a new option --allow-multiple-messages to print out such messages in the future, by default it only prints and handles the first one.

When printing a text stream with a GPG signature it was possible for an attacker to create a stream with 'unsigned text, signed text' where both unsigned and signed text would be shown without distinction which one was signed and which part wasn't.

This is tracked by the Mitre CVE ID CVE-2007-1263.

The update introduces a new option

-allow-multiple-messages to print out such messages in the future, by default it only prints and handles the first one.

USN-432-1 fixed a vulnerability in GnuPG. This update provides the corresponding updates for GnuPG2 and the GPGME library.

Gerardo Richarte from Core Security Technologies discovered that when gnupg is used without --status-fd, there is no way to distinguish initial unsigned messages from a following signed message. An attacker could inject an unsigned message, which could fool the user into thinking the message was entirely signed by the original sender.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gerardo Richarte from Core Security Technologies discovered that when gnupg is used without --status-fd, there is no way to distinguish initial unsigned messages from a following signed message. An attacker could inject an unsigned message, which could fool the user into thinking the message was entirely signed by the original sender.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

When printing a text stream with a GPG signature it was possible for an attacker to create a stream with 'unsigned text, signed text' where both unsigned and signed text would be shown without distinction which one was signed and which part wasn't.

This is tracked by the Mitre CVE ID CVE-2007-1263.

The update introduces a new option

--allow-multiple-messages to print out such messages in the future, by default it only prints and handles the first one.

Updated GnuPG packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Gerardo Richarte discovered that a number of applications that make use of GnuPG are prone to a vulnerability involving incorrect verification of signatures and encryption. An attacker could add arbitrary content to a signed message in such a way that a receiver of the message would not be able to distinguish between the properly signed parts of a message and the forged, unsigned, parts.
(CVE-2007-1263)

Whilst this is not a vulnerability in GnuPG itself, the GnuPG team have produced a patch to protect against messages with multiple plaintext packets. Users should update to these erratum packages which contain the backported patch for this issue.

Red Hat would like to thank Core Security Technologies for reporting this issue.

This updates GnuPG to version 1.4.7, changing the default behavior so that gnupg now flags message streams which contain multiple plaintexts as an error. This prevents errors which would occur when applications which called gnupg assumed that this was already the default behavior.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gerardo Richarte discovered that GnuPG, a free PGP replacement, provides insufficient user feedback if an OpenPGP message contains both unsigned and signed portions. Inserting text segments into an otherwise signed message could be exploited to forge the content of signed messages. This update prevents such attacks; the old behaviour can still be activated by passing the --allow-multiple-messages option.

The remote host is running GnuPG.  This version is vulnerable to a number of security and privacy flaws.

GnuPG prior to 1.4.7 and GPGME prior to 1.1.4, when run from the command line, did not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components. This could allow a remote attacker to forge the contents of an email message without detection.

GnuPG 1.4.7 is being provided with this update and GPGME has been patched on Mandriva 2007.0 to provide better visual notification on these types of forgeries.

New gnupg packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix security ramifications of incorrect gpg usage.

Updated GnuPG packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Gerardo Richarte discovered that a number of applications that make use of GnuPG are prone to a vulnerability involving incorrect verification of signatures and encryption. An attacker could add arbitrary content to a signed message in such a way that a receiver of the message would not be able to distinguish between the properly signed parts of a message and the forged, unsigned, parts.
(CVE-2007-1263)

Whilst this is not a vulnerability in GnuPG itself, the GnuPG team have produced a patch to protect against messages with multiple plaintext packets. Users should update to these erratum packages which contain the backported patch for this issue.

Red Hat would like to thank Core Security Technologies for reporting this issue.

ID	Name	Product	Family	Severity
67460	Oracle Linux 5 : gnupg (ELSA-2007-0107)	Nessus	Oracle Linux Local Security Checks	medium
67459	Oracle Linux 3 / 4 : gnupg (ELSA-2007-0106)	Nessus	Oracle Linux Local Security Checks	medium
41120	SuSE9 Security Update : gpg (YOU Patch Number 11464)	Nessus	SuSE Local Security Checks	medium
29450	SuSE 10 Security Update : gpg (ZYPP Patch Number 2994)	Nessus	SuSE Local Security Checks	medium
28027	Ubuntu 6.06 LTS / 6.10 : gnupg2, gpgme1.0 vulnerability (USN-432-2)	Nessus	Ubuntu Local Security Checks	medium
28026	Ubuntu 5.10 / 6.06 LTS / 6.10 : gnupg vulnerability (USN-432-1)	Nessus	Ubuntu Local Security Checks	high
27248	openSUSE 10 Security Update : gpg (gpg-2995)	Nessus	SuSE Local Security Checks	medium
25320	RHEL 5 : gnupg (RHSA-2007:0107)	Nessus	Red Hat Local Security Checks	medium
24822	Fedora Core 5 : gnupg-1.4.7-1 (2007-316)	Nessus	Fedora Local Security Checks	medium
24821	Fedora Core 6 : gnupg-1.4.7-2 (2007-315)	Nessus	Fedora Local Security Checks	medium
24819	Debian DSA-1266-1 : gnupg - several vulnerabilities	Nessus	Debian Local Security Checks	medium
3948	GnuPG < 1.4.7 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	medium
24809	Mandrake Linux Security Advisory : gnupg (MDKSA-2007:059)	Nessus	Mandriva Local Security Checks	high
24787	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 9.0 / 9.1 : gnupg (SSA:2007-066-01)	Nessus	Slackware Local Security Checks	medium
24775	RHEL 2.1 / 3 / 4 : gnupg (RHSA-2007:0106)	Nessus	Red Hat Local Security Checks	medium
24764	CentOS 3 / 4 : gnupg (CESA-2007:0106)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-1263

high

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

high

medium

medium

medium