Stay Secure with the Latest Linux Advisories

security advisoryUbuntumoderate threat

Ubuntu 14.04 LTS: USN-2021-2 Critical: Libgcrypt Vulnerability

GnuPG could be tricked into downloading a different key when downloading from a key server.. =========================================================================Ubuntu Security Notice USN-1570-1 September 17, 2012 gnupg, gnupg2 vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS Summary: GnuPG could be tricked into downloading a different key when downloading from a key server. Software Description: - gnupg: GNU privacy guard - a free PGP replacement - gnupg2: GNU privacy guard - a free PGP replacement Details: It was discovered that GnuPG used a short ID when downloading keys from a keyserver, even if a long ID was requested. An attacker could possibly use this to return a different key with a duplicate short key id. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: gnupg 1.4.11-3ubuntu2.1 gnupg2 2.0.17-2ubuntu2.12.04.1 Ubuntu 11.10: gnupg 1.4.11-3ubuntu1.11.10.1 gnupg2 2.0.17-2ubuntu2.11.10.1 Ubuntu 11.04: gnupg 1.4.11-3ubuntu1.11.04.1 gnupg2 2.0.14-2ubuntu1.2 Ubuntu 10.04 LTS: gnupg 1.4.10-2ubuntu1.1 gnupg2 2.0.14-1ubuntu1.4 Ubuntu 8.04 LTS: gnupg 1.4.6-2ubuntu5.1 gnupg2 2.0.7-1ubuntu0.2 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-1570-1 https://bugs.launchpad.net/ubuntu/+source/software-properties/+bug/1016643 Package Information: https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu2.1 https://launchpad.net/ubuntu/+source/gnupg2/2.0.17-2ubuntu2.12.04.1 https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu1.11.10.1 https://launchpad.net/ubuntu/+source/gnupg2/2.0.17-2ubuntu2.11.10.1 https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu1.11.04.1 https://launchpad.net/ubuntu/+source/gnupg2/2.0.14-2ubuntu1.2 https://launchpad.net/ubuntu/+source/gnupg/1.4.10-2ubuntu1.1 https://launchpad.net/ubuntu/+source/gnupg2/2.0.14-1ubuntu1.4 https://launchpad.net/ubuntu/+source/gnupg/1.4.6-2ubuntu5.1 https://launchpad.net/ubuntu/+source/gnupg2/2.0.7-1ubuntu0.2 . A GnuPG flaw enables malicious actors to deceive users into retrieving erroneous keys from key repositories across various Ubuntu versions.. GnuPG Security, Keyserver Attack, Ubuntu Update. . Severity: Critical. LinuxSecurity.com Team

Sep 17, 2012 •Critical Ubuntu