Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.

GnuPG2 was vulnerable to arbitrary code execution by context-dependent attackers because of reusing a freed pointer when verifying a signature or importing a certificate with many 'Subject Alternate Names'. (CVE-2010-2547)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2010-0603 advisory.

    [2.0.10-3.1]
    - fix use after free when importing certain X509 certificates       CVE-2010-2547 (#618156)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A use-after-free flaw was found in the way gpgsm, a Cryptographic Message Syntax (CMS) encryption and signing tool, handled X.509 certificates with a large number of Subject Alternate Names. A specially crafted X.509 certificate could, when imported, cause gpgsm to crash or, possibly, execute arbitrary code. (CVE-2010-2547)

The remote host is affected by the vulnerability described in GLSA-201110-15 (GnuPG: User-assisted execution of arbitrary code)

    The GPGSM utility in GnuPG contains a use-after-free vulnerability that       may be exploited when importing a crafted X.509 certificate explicitly or       during the signature verification process.
  Impact :

    An unauthenticated remote attacker may execute arbitrary code with the       privileges of the user running GnuPG by enticing them to import a crafted       certificate.
  Workaround :

    There is no known workaround at this time.

This update fixes a vulnerability of GnuPG2 to arbitrary code execution by context-dependent attackers due to reusing a freed pointer when verifying a signature or importing a certificate with many 'Subject Alternate Names'. (CVE-2010-2547)

New gnupg2 packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix a security issue.

It was discovered that GPGSM in GnuPG2 did not correctly handle certificates with a large number of Subject Alternate Names. If a user or automated system were tricked into processing a specially crafted certificate, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated gnupg2 package that fixes one security issue is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with the proposed OpenPGP Internet standard and the S/MIME standard.

A use-after-free flaw was found in the way gpgsm, a Cryptographic Message Syntax (CMS) encryption and signing tool, handled X.509 certificates with a large number of Subject Alternate Names. A specially crafted X.509 certificate could, when imported, cause gpgsm to crash or, possibly, execute arbitrary code. (CVE-2010-2547)

All gnupg2 users should upgrade to this updated package, which contains a backported patch to correct this issue.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2010:0603 advisory.

  - GnuPG 2: use-after-free when importing certificate with many alternate names (CVE-2010-2547)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Fri Jul 23 2010 Rex Dieter <rdieter at     fedoraproject.org> - 2.0.14-4

    - gpgsm realloc patch

    - Fri Jun 18 2010 Tomas Mraz <tmraz at redhat.com> -       2.0.14-3

    - initialize small amount of secmem for list of       algorithms in help (#598847) (necessary in the FIPS       mode of libgcrypt)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in gnupg2 :

Importing a certificate with more than 98 Subject Alternate Names via GPGSM's import command or implicitly while verifying a signature causes GPGSM to reallocate an array with the names. The bug is that the reallocation code misses assigning the reallocated array to the old array variable and thus the old and freed array will be used.
Usually this leads to a segv (CVE-2010-2547).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

It was discovered that GnuPG 2 uses a freed pointer when verifying a signature or importing a certificate with many Subject Alternate Names, potentially leading to arbitrary code execution.

ID	Name	Product	Family	Severity
75523	openSUSE Security Update : gpg2 (openSUSE-SU-2010:0479-1)	Nessus	SuSE Local Security Checks	medium
68078	Oracle Linux 5 : gnupg2 (ELSA-2010-0603)	Nessus	Oracle Linux Local Security Checks	high
60829	Scientific Linux Security Update : gnupg2 on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56590	GLSA-201110-15 : GnuPG: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
50913	SuSE 11 / 11.1 Security Update : gpg2 (SAT Patch Numbers 2820 / 2822)	Nessus	SuSE Local Security Checks	medium
49856	SuSE 10 Security Update : gpg2 (ZYPP Patch Number 7107)	Nessus	SuSE Local Security Checks	medium
48919	Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : gnupg2 (SSA:2010-240-01)	Nessus	Slackware Local Security Checks	medium
48315	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : gnupg2 vulnerability (USN-970-1)	Nessus	Ubuntu Local Security Checks	medium
48268	CentOS 5 : gnupg2 (CESA-2010:0603)	Nessus	CentOS Local Security Checks	medium
48260	openSUSE Security Update : gpg2 (openSUSE-SU-2010:0479-1)	Nessus	SuSE Local Security Checks	medium
48259	openSUSE Security Update : gpg2 (openSUSE-SU-2010:0479-1)	Nessus	SuSE Local Security Checks	medium
48252	RHEL 5 : gnupg2 (RHSA-2010:0603)	Nessus	Red Hat Local Security Checks	high
48229	Fedora 13 : gnupg2-2.0.14-4.fc13 (2010-11413)	Nessus	Fedora Local Security Checks	medium
48209	Mandriva Linux Security Advisory : gnupg2 (MDVSA-2010:143)	Nessus	Mandriva Local Security Checks	medium
47890	Debian DSA-2076-1 : gnupg2 - use-after-free	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2010-2547

high

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium