Gerardo Richarte from Core Security Technologies discovered that when gnupg is used without --status-fd, there is no way to distinguish initial unsigned messages from a following signed message.

=========================================================== 
Ubuntu Security Notice USN-432-1             March 08, 2007
gnupg vulnerability
CVE-2007-1263
==========================================================
A security issue affects the following Ubuntu releases:

Ubuntu 5.10
Ubuntu 6.06 LTS
Ubuntu 6.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 5.10:
  gnupg                                    1.4.1-1ubuntu1.7

Ubuntu 6.06 LTS:
  gnupg                                    1.4.2.2-1ubuntu2.5

Ubuntu 6.10:
  gnupg                                    1.4.3-2ubuntu3.3

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Gerardo Richarte from Core Security Technologies discovered that when 
gnupg is used without --status-fd, there is no way to distinguish 
initial unsigned messages from a following signed message.  An attacker 
could inject an unsigned message, which could fool the user into 
thinking the message was entirely signed by the original sender.


Updated packages for Ubuntu 5.10:

  Source archives:

          Size/MD5:    25425 95c70d62c7e93b0a294250f1ef8bffbc
          Size/MD5:      684 80528a24f59f9dc0063a6640d49d2879
          Size/MD5:  4059170 1cc77c6943baaa711222e954bbd785e5

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

          Size/MD5:  1136974 ab221f5e755ffcb88f9db8be00d2b78c
          Size/MD5:   152330 4babe71c8a3f93bcc1169dfc60e47b89

  i386 architecture (x86 compatible Intel/AMD)

          Size/MD5:  1045290 eeb54cf2e3b201b2c813507b537dae81
          Size/MD5:   130812 86c1ee88f32bf5e4a35144d22e42024b

  powerpc architecture (Apple Macintosh G3/G4/G5)

          Size/MD5:  1120350 8c0a11b1b29093e2a6fc198d93bee8f0
          Size/MD5:   140330 8bf6e199e1ed859d65f015f8f5a6fe05

  sparc architecture (Sun SPARC/UltraSPARC)

          Size/MD5:  1065120 25a911b1644da3be8880221f002f8563
          Size/MD5:   139740 80e9a3c9748f918745c5417ea64ce06a

Updated packages for Ubuntu 6.06 LTS:

  Source archives:

          Size/MD5:    24318 aa78ecc4d9dd51b8d4084e152093e6be
          Size/MD5:      690 460f793de7cea304ac0e038bf4e8f348
          Size/MD5:  4222685 50d8fd9c5715ff78b7db0e5f20d08550

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

          Size/MD5:  1066892 bebab8ec7afe738b426e080f10af9c37
          Size/MD5:   140414 8b9f2ca68439062984c4314ba5c0e2d8

  i386 architecture (x86 compatible Intel/AMD)

          Size/MD5:   981952 bd95db0369ba517b3f29ec132676fcc5
          Size/MD5:   120392 188d1f1cb3ec385c444e623d9efcadde

  powerpc architecture (Apple Macintosh G3/G4/G5)

          Size/MD5:  1054420 0da3379c332cb3786933861ec66c9478
          Size/MD5:   130262 c528d3f517f94a50ecd06a10b5767c84

  sparc architecture (Sun SPARC/UltraSPARC)

          Size/MD5:   994884 159220ec1a5c667a073e13e63380fd49
          Size/MD5:   127548 755511f26f78dd7744434601d684404b

Updated packages for Ubuntu 6.10:

  Source archives:

          Size/MD5:    29804 2f3b7d22a447212c871a1ca6ff754df7
          Size/MD5:      697 54eb12ebf5f4426abe78eb286c32ec35
          Size/MD5:  4320394 fcdf572a33dd037653707b128dd150a7

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

          Size/MD5:   380186 ac0b24986f64b7be4da102509f86ea27
          Size/MD5:  1112634 339bb8b52507096e2a1f9cb75864629f
          Size/MD5:   142772 a460f38f4669944e3c8cdbff531b4a41

  i386 architecture (x86 compatible Intel/AMD)

          Size/MD5:   357730 08dee030fef6b31ba21b92d56b134cad
          Size/MD5:  1056104 826246d40bdd92c0b04a0c0d385e4a64
          Size/MD5:   129176 8d173c26de67072948c7f34dfceb75ae

  powerpc architecture (Apple Macintosh G3/G4/G5)

          Size/MD5:   372730 c3dd8be3260d14e82a4af95f37c6616d
          Size/MD5:  1107684 1a8a6be788ab4afd0c33483f5faa6a1f
          Size/MD5:   136440 ee71f2b32e7e085488e134ba68f89122

  sparc architecture (Sun SPARC/UltraSPARC)

          Size/MD5:   366290 90570b1dafeb0a01862c5768579564a3
          Size/MD5:  1042784 e8b19dfe7705afbde9c54b223e44dcba
          Size/MD5:   132868 edc923da480a84aa4d060c8d7be58be2