=========================================================== Ubuntu Security Notice USN-432-1 March 08, 2007 gnupg vulnerability CVE-2007-1263 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 5.10 Ubuntu 6.06 LTS Ubuntu 6.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 5.10: gnupg 1.4.1-1ubuntu1.7 Ubuntu 6.06 LTS: gnupg 1.4.2.2-1ubuntu2.5 Ubuntu 6.10: gnupg 1.4.3-2ubuntu3.3 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Gerardo Richarte from Core Security Technologies discovered that when gnupg is used without --status-fd, there is no way to distinguish initial unsigned messages from a following signed message. An attacker could inject an unsigned message, which could fool the user into thinking the message was entirely signed by the original sender. Updated packages for Ubuntu 5.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7.diff.gz Size/MD5: 25425 95c70d62c7e93b0a294250f1ef8bffbc http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7.dsc Size/MD5: 684 80528a24f59f9dc0063a6640d49d2879 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1.orig.tar.gz Size/MD5: 4059170 1cc77c6943baaa711222e954bbd785e5 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7_amd64.deb Size/MD5: 1136974 ab221f5e755ffcb88f9db8be00d2b78c http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ubuntu1.7_amd64.udeb Size/MD5: 152330 4babe71c8a3f93bcc1169dfc60e47b89 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7_i386.deb Size/MD5: 1045290 eeb54cf2e3b201b2c813507b537dae81 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ubuntu1.7_i386.udeb Size/MD5: 130812 86c1ee88f32bf5e4a35144d22e42024b powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7_powerpc.deb Size/MD5: 1120350 8c0a11b1b29093e2a6fc198d93bee8f0 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ubuntu1.7_powerpc.udeb Size/MD5: 140330 8bf6e199e1ed859d65f015f8f5a6fe05 sparc architecture (Sun SPARC/UltraSPARC) http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu1.7_sparc.deb Size/MD5: 1065120 25a911b1644da3be8880221f002f8563 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ubuntu1.7_sparc.udeb Size/MD5: 139740 80e9a3c9748f918745c5417ea64ce06a Updated packages for Ubuntu 6.06 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5.diff.gz Size/MD5: 24318 aa78ecc4d9dd51b8d4084e152093e6be http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5.dsc Size/MD5: 690 460f793de7cea304ac0e038bf4e8f348 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2.orig.tar.gz Size/MD5: 4222685 50d8fd9c5715ff78b7db0e5f20d08550 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5_amd64.deb Size/MD5: 1066892 bebab8ec7afe738b426e080f10af9c37 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1ubuntu2.5_amd64.udeb Size/MD5: 140414 8b9f2ca68439062984c4314ba5c0e2d8 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5_i386.deb Size/MD5: 981952 bd95db0369ba517b3f29ec132676fcc5 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1ubuntu2.5_i386.udeb Size/MD5: 120392 188d1f1cb3ec385c444e623d9efcadde powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5_powerpc.deb Size/MD5: 1054420 0da3379c332cb3786933861ec66c9478 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1ubuntu2.5_powerpc.udeb Size/MD5: 130262 c528d3f517f94a50ecd06a10b5767c84 sparc architecture (Sun SPARC/UltraSPARC) http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubuntu2.5_sparc.deb Size/MD5: 994884 159220ec1a5c667a073e13e63380fd49 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1ubuntu2.5_sparc.udeb Size/MD5: 127548 755511f26f78dd7744434601d684404b Updated packages for Ubuntu 6.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3.diff.gz Size/MD5: 29804 2f3b7d22a447212c871a1ca6ff754df7 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3.dsc Size/MD5: 697 54eb12ebf5f4426abe78eb286c32ec35 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3.orig.tar.gz Size/MD5: 4320394 fcdf572a33dd037653707b128dd150a7 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.3-2ubuntu3.3_amd64.udeb Size/MD5: 380186 ac0b24986f64b7be4da102509f86ea27 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3_amd64.deb Size/MD5: 1112634 339bb8b52507096e2a1f9cb75864629f http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ubuntu3.3_amd64.udeb Size/MD5: 142772 a460f38f4669944e3c8cdbff531b4a41 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.3-2ubuntu3.3_i386.udeb Size/MD5: 357730 08dee030fef6b31ba21b92d56b134cad http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3_i386.deb Size/MD5: 1056104 826246d40bdd92c0b04a0c0d385e4a64 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ubuntu3.3_i386.udeb Size/MD5: 129176 8d173c26de67072948c7f34dfceb75ae powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.3-2ubuntu3.3_powerpc.udeb Size/MD5: 372730 c3dd8be3260d14e82a4af95f37c6616d http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3_powerpc.deb Size/MD5: 1107684 1a8a6be788ab4afd0c33483f5faa6a1f http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ubuntu3.3_powerpc.udeb Size/MD5: 136440 ee71f2b32e7e085488e134ba68f89122 sparc architecture (Sun SPARC/UltraSPARC) http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.3-2ubuntu3.3_sparc.udeb Size/MD5: 366290 90570b1dafeb0a01862c5768579564a3 http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu3.3_sparc.deb Size/MD5: 1042784 e8b19dfe7705afbde9c54b223e44dcba http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ubuntu3.3_sparc.udeb Size/MD5: 132868 edc923da480a84aa4d060c8d7be58be2