A new GnuPG vulnerability update is available for Ubuntu Linux. Here the announcement:
Ubuntu Security Notice USN-432-1 March 08, 2007
gnupg vulnerability
CVE-2007-1263
==========================
==========================
=========
A security issue affects the following Ubuntu releases:
Ubuntu 5.10
Ubuntu 6.06 LTS
Ubuntu 6.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 5.10:
gnupg 1.4.1-1ubuntu1.7
Ubuntu 6.06 LTS:
gnupg 1.4.2.2-1ubuntu2.5
Ubuntu 6.10:
gnupg 1.4.3-2ubuntu3.3
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
Gerardo Richarte from Core Security Technologies discovered that when
gnupg is used without --status-fd, there is no way to distinguish
initial unsigned messages from a following signed message. An attacker
could inject an unsigned message, which could fool the user into
thinking the message was entirely signed by the original sender.
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu=
1.7.diff.gz
Size/MD5: 25425 95c70d62c7e93b0a294250f1ef8bffbc
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu=
1.7.dsc
Size/MD5: 684 80528a24f59f9dc0063a6640d49d2879
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1.orig.ta=
r.gz
Size/MD5: 4059170 1cc77c6943baaa711222e954bbd785e5
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu=
1.7_amd64.deb
Size/MD5: 1136974 ab221f5e755ffcb88f9db8be00d2b78c
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ub=
untu1.7_amd64.udeb
Size/MD5: 152330 4babe71c8a3f93bcc1169dfc60e47b89
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu=
1.7_i386.deb
Size/MD5: 1045290 eeb54cf2e3b201b2c813507b537dae81
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ub=
untu1.7_i386.udeb
Size/MD5: 130812 86c1ee88f32bf5e4a35144d22e42024b
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu=
1.7_powerpc.deb
Size/MD5: 1120350 8c0a11b1b29093e2a6fc198d93bee8f0
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ub=
untu1.7_powerpc.udeb
Size/MD5: 140330 8bf6e199e1ed859d65f015f8f5a6fe05
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.1-1ubuntu=
1.7_sparc.deb
Size/MD5: 1065120 25a911b1644da3be8880221f002f8563
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.1-1ub=
untu1.7_sparc.udeb
Size/MD5: 139740 80e9a3c9748f918745c5417ea64ce06a
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubun=
tu2.5.diff.gz
Size/MD5: 24318 aa78ecc4d9dd51b8d4084e152093e6be
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubun=
tu2.5.dsc
Size/MD5: 690 460f793de7cea304ac0e038bf4e8f348
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2.orig.=
tar.gz
Size/MD5: 4222685 50d8fd9c5715ff78b7db0e5f20d08550
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubun=
tu2.5_amd64.deb
Size/MD5: 1066892 bebab8ec7afe738b426e080f10af9c37
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1=
ubuntu2.5_amd64.udeb
Size/MD5: 140414 8b9f2ca68439062984c4314ba5c0e2d8
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubun=
tu2.5_i386.deb
Size/MD5: 981952 bd95db0369ba517b3f29ec132676fcc5
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1=
ubuntu2.5_i386.udeb
Size/MD5: 120392 188d1f1cb3ec385c444e623d9efcadde
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubun=
tu2.5_powerpc.deb
Size/MD5: 1054420 0da3379c332cb3786933861ec66c9478
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1=
ubuntu2.5_powerpc.udeb
Size/MD5: 130262 c528d3f517f94a50ecd06a10b5767c84
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.2.2-1ubun=
tu2.5_sparc.deb
Size/MD5: 994884 159220ec1a5c667a073e13e63380fd49
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.2.2-1=
ubuntu2.5_sparc.udeb
Size/MD5: 127548 755511f26f78dd7744434601d684404b
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu=
3.3.diff.gz
Size/MD5: 29804 2f3b7d22a447212c871a1ca6ff754df7
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu=
3.3.dsc
Size/MD5: 697 54eb12ebf5f4426abe78eb286c32ec35
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3.orig.ta=
r.gz
Size/MD5: 4320394 fcdf572a33dd037653707b128dd150a7
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.=
3-2ubuntu3.3_amd64.udeb
Size/MD5: 380186 ac0b24986f64b7be4da102509f86ea27
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu=
3.3_amd64.deb
Size/MD5: 1112634 339bb8b52507096e2a1f9cb75864629f
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ub=
untu3.3_amd64.udeb
Size/MD5: 142772 a460f38f4669944e3c8cdbff531b4a41
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.=
3-2ubuntu3.3_i386.udeb
Size/MD5: 357730 08dee030fef6b31ba21b92d56b134cad
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu=
3.3_i386.deb
Size/MD5: 1056104 826246d40bdd92c0b04a0c0d385e4a64
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ub=
untu3.3_i386.udeb
Size/MD5: 129176 8d173c26de67072948c7f34dfceb75ae
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.=
3-2ubuntu3.3_powerpc.udeb
Size/MD5: 372730 c3dd8be3260d14e82a4af95f37c6616d
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu=
3.3_powerpc.deb
Size/MD5: 1107684 1a8a6be788ab4afd0c33483f5faa6a1f
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ub=
untu3.3_powerpc.udeb
Size/MD5: 136440 ee71f2b32e7e085488e134ba68f89122
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/universe/g/gnupg/gnupg-udeb_1.4.=
3-2ubuntu3.3_sparc.udeb
Size/MD5: 366290 90570b1dafeb0a01862c5768579564a3
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gnupg_1.4.3-2ubuntu=
3.3_sparc.deb
Size/MD5: 1042784 e8b19dfe7705afbde9c54b223e44dcba
http://security.ubuntu.com/ubuntu/pool/main/g/gnupg/gpgv-udeb_1.4.3-2ub=
untu3.3_sparc.udeb
Size/MD5: 132868 edc923da480a84aa4d060c8d7be58be2
--UoPmpPX/dBe4BELn
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFF77WRH/9LqRcGPm0RAn/BAKCaGBlDKDYXZHdMmQdNLmFx8ieFawCgjlh2
CJi8jmwJsY7lbIUHwgDKUow=
=aiWf
-----END PGP SIGNATURE-----
