SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   GnuPG (Gnu Privacy Guard) Vendors:   Gnupg.org
(Red Hat Issues Fix) GnuPG Filename Input Validation Flaw Lets Remote Users Spoof Status Messages
SecurityTracker Alert ID:  1041276
SecurityTracker URL:  http://securitytracker.com/id/1041276
CVE Reference:   CVE-2018-12020   (Links to External Site)
Date:  Jul 12 2018
Impact:   Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  

Description:   A vulnerability was reported in GnuPG. A remote user can spoof status messages.

A remote user can send a signed and encrypted email message that includes the specially crafted name of the original input file to trigger an input validation flaw in the processing of filenames when displaying the filename. This can be exploited to spoof status messages and fake the verification status of a signed email message.

Applications that use the GPGME library are not affected.

Marcus Brinkmann reported this vulnerability.

Impact:   A remote user can spoof status messages and fake the verification status of a signed email message.
Solution:   Red Hat has issued a fix.

The Red Hat advisory is available at:

https://access.redhat.com/errata/RHSA-2018:2180

Vendor URL:  access.redhat.com/errata/RHSA-2018:2180 (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  6

Message History:   This archive entry is a follow-up to the message listed below.
Jun 10 2018 GnuPG Filename Input Validation Flaw Lets Remote Users Spoof Status Messages



 Source Message Contents

Subject:  [RHSA-2018:2180-01] Important: gnupg2 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: gnupg2 security update
Advisory ID:       RHSA-2018:2180-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2180
Issue date:        2018-07-11
CVE Names:         CVE-2018-12020 
=====================================================================

1. Summary:

An update for gnupg2 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and
creating digital signatures, compliant with OpenPGP and S/MIME standards.

Security Fix(es):

* gnupg2: Improper sanitization of filenames allows for the display of fake
status messages and the bypass of signature verification (CVE-2018-12020)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1589620 - CVE-2018-12020 gnupg2: Improper sanitization of filenames allows for the display of fake status messages and the bypass of signature verification

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
gnupg2-2.0.14-9.el6_10.src.rpm

i386:
gnupg2-2.0.14-9.el6_10.i686.rpm
gnupg2-debuginfo-2.0.14-9.el6_10.i686.rpm

x86_64:
gnupg2-2.0.14-9.el6_10.x86_64.rpm
gnupg2-debuginfo-2.0.14-9.el6_10.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

i386:
gnupg2-debuginfo-2.0.14-9.el6_10.i686.rpm
gnupg2-smime-2.0.14-9.el6_10.i686.rpm

x86_64:
gnupg2-debuginfo-2.0.14-9.el6_10.x86_64.rpm
gnupg2-smime-2.0.14-9.el6_10.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
gnupg2-2.0.14-9.el6_10.src.rpm

x86_64:
gnupg2-2.0.14-9.el6_10.x86_64.rpm
gnupg2-debuginfo-2.0.14-9.el6_10.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

x86_64:
gnupg2-debuginfo-2.0.14-9.el6_10.x86_64.rpm
gnupg2-smime-2.0.14-9.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
gnupg2-2.0.14-9.el6_10.src.rpm

i386:
gnupg2-2.0.14-9.el6_10.i686.rpm
gnupg2-debuginfo-2.0.14-9.el6_10.i686.rpm

ppc64:
gnupg2-2.0.14-9.el6_10.ppc64.rpm
gnupg2-debuginfo-2.0.14-9.el6_10.ppc64.rpm

s390x:
gnupg2-2.0.14-9.el6_10.s390x.rpm
gnupg2-debuginfo-2.0.14-9.el6_10.s390x.rpm

x86_64:
gnupg2-2.0.14-9.el6_10.x86_64.rpm
gnupg2-debuginfo-2.0.14-9.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

i386:
gnupg2-debuginfo-2.0.14-9.el6_10.i686.rpm
gnupg2-smime-2.0.14-9.el6_10.i686.rpm

ppc64:
gnupg2-debuginfo-2.0.14-9.el6_10.ppc64.rpm
gnupg2-smime-2.0.14-9.el6_10.ppc64.rpm

s390x:
gnupg2-debuginfo-2.0.14-9.el6_10.s390x.rpm
gnupg2-smime-2.0.14-9.el6_10.s390x.rpm

x86_64:
gnupg2-debuginfo-2.0.14-9.el6_10.x86_64.rpm
gnupg2-smime-2.0.14-9.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
gnupg2-2.0.14-9.el6_10.src.rpm

i386:
gnupg2-2.0.14-9.el6_10.i686.rpm
gnupg2-debuginfo-2.0.14-9.el6_10.i686.rpm

x86_64:
gnupg2-2.0.14-9.el6_10.x86_64.rpm
gnupg2-debuginfo-2.0.14-9.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

i386:
gnupg2-debuginfo-2.0.14-9.el6_10.i686.rpm
gnupg2-smime-2.0.14-9.el6_10.i686.rpm

x86_64:
gnupg2-debuginfo-2.0.14-9.el6_10.x86_64.rpm
gnupg2-smime-2.0.14-9.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-12020
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW0ZtCNzjgjWX9erEAQgddw//Y96xnYezsStXb6heP6/GrFd0mo9gydZA
Tr5DsvnMqSY7B/iUkh/0hkvhBZBE89gQP6twcAY4OS1eHK217pxCpWqNfOnGhXK7
i4KM9WtdqKa7hpI1aeWkphEOcYRV2b6DrmDW4Hf4jxG4J2f2zcZbWGQVP5Z9idbc
xBoQsJpYvpdXPDAL7vv5wnzbK5Dc0CNWxydfA+K5/BCueCPPRSfoK2cnYuRt6mAg
wQx4SJnijZQ1FzQTV+RJA29gSWJwd+pZnYXDW74nB4FkOM617g7/5YlvwN+pXrM/
pwv5s7HfWIaJmNmOUHbTos7E5PgshwretO9SDTqFPoPw8EoRnvvJHLWQ/FpQnrQw
KnWhjeb3Z+mrKJzcYcTMcWtd+LTt6ETaSW6GWmVnp+4eZj+onSzRmoa5h9qxLXf8
RzE8+vawkGGK+Nm5IYPfEONf6NybWCXBHpsv08LYvTHnJ2l5ffrq1qAuLL17Rz3l
iHSgwezVmZrvuRRGj6hNb5nsQNHhN63HMRZOozBqMJHQWO311JAuE7fUjUQh250v
XXWKFmEKV5wMiyVP1Bh0ncQN78Npi9nV9l3eTFYrk02deM1eMpYLIqR/Qjn0pJM/
Znox28Mwicn8CeWP0GxXRi9wm/Xhc42lJU/q2xT8HoQVceX7/A9N5QLZ8D7RAJ9j
Y8JFV4j2H3g=
=aPvB
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC