This script is Copyright (C) 2006-2010 Tenable Network Security, Inc.
The remote host is missing a vendor-supplied security patch
The remote host is missing the patch for the advisory SUSE-SA:2006:014 (gpg).
The GNU Privacy Guard (GPG) allows crafting a message which could
check out correct using '--verify', but would extract a different,
potentially malicious content when using '-o --batch'.
The reason for this is that a .gpg or .asc file can contain multiple
plain text and signature streams and the handling of these streams was
only possible when correctly following the gpg state.
The gpg '--verify' option has been changed to be way more strict than
before and fail on files with multiple signatures/blocks to mitigate
the problem of doing the common --verify checks and -o extraction.
This problem could be used by an attacker to remotely execute code
by using handcrafted YaST Online Patch files put onto a compromised
YOU mirror server and waiting for the user to run YOU.
This problem is tracked by the Mitre CVE ID CVE-2006-0049.
This is a different issue than the gpg signature checking problem for
Risk factor :
Get Nessus Professional to scan unlimited IPs, run compliance checks & moreBuy Nessus Professional Now