Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
100
security advisorycriticalremote code executionSUSE: 2006-013 Critical: GPG Signature Problems - Remote Code Execution
This is a reissue of SUSE-SA:2006:009, after we found out that also This is a reissue of SUSE-SA:2006:009, after we found out that also gpg version < 1.4.x are affected by the signature checking problem gpg version < 1.4.x are affected by the signature checking problem of CVE-2006-0455. With certain handcraft-able signatures GPG was returning a 0 (valid signature) when used on command-line with o [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: gpg,liby2util Announcement ID: SUSE-SA:2006:013 Date: Wed, 01 Mar 2006 11:00:00 +0000 Affected Products: SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 SUSE LINUX 9.1 SuSE Linux Desktop 1.0 SuSE Linux Enterprise Server 8 SUSE LINUX Enterprise Server 9 UnitedLinux 1.0 Open Enterprise Server 1 Novell Linux Desktop 9 Vulnerability Type: remote code execution Severity (1-10): 9 SUSE Default Package: yes Cross-References: CVE-2006-0455, CVE-2006-0803 Content of This Advisory: 1) Security Vulnerability Resolved: gpg signature checking problems Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This is a reissue of SUSE-SA:2006:009, after we found outthat also gpg version < 1.4.x are affected by the signature checking problem of CVE-2006-0455. With certain handcraft-able signatures GPG was returning a 0 (valid signature) when used on command-line with option --verify. This could make automated checkers, like for instance the patch file verification checker of the YaST Online Update, pass malicious patch files as correct and allow remote code execution. This is tracked by the Mitre CVE ID CVE-2006-0455. Also, the YaST Online Update script signature verification had used a feature which was not meant to be used for signature verification, making it possible to supply any kind of script which would be considered correct. This would also allow code execution. This issue is tracked by the Mitre CVE ID CVE-2006-0803. Both attacks require an attacker either manipulating a YaST Online Update mirror or manipulating the network traffic between the mirror and your machine. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes None. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv to apply the update, replacing with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.0: 91697f9207b20931d669f9f6d085b816 c6815c8ff1cc695f91cf9c1ba6960554 SUSE LINUX 9.3: a321ab146d07c50cc69a91352ac28bf7 1215bcf8f061079dbe05b93b1d611818 SUSE LINUX 9.2: 3df19ea2069732c17da1b150d76fdba1 ab21dd4a8f561abba2cd5b25e3076e41 e1b45fbf2b326e7a4d06d1fa23100415 SUSE LINUX 9.1: 5ea37344f72e28ff06f40976081e6499 dcdaf21f345b2d4ffa55a78c74625633 18624f647f80b9e39a8c910c90d60c87 Power PC Platform: SUSE LINUX 10.0: 584b0cc0fadc160148b98976cbb9abb8 dcc926d75e15cda7c83e6ab110defd1f x86-64 Platform: SUSE LINUX 10.0: 712892d9238ad5ae230837f89528a4c1 ea0e06b186f3ffe7df066888b69e64fe SUSE LINUX 9.3: 7cd1425a429b4637b34aa675d4eeaa85 8d27157261b70a5bb51ab643d8dd1fe8 SUSE LINUX 9.2: 9e0fb9977027d7b95006ac6405a1befc b33ebf6703546c56ec10eea205e4fbd8 6b385cd9d0902eeede67267933248404 SUSE LINUX 9.1: d05a99f75d4089a56b2f21c2b7aca67a d1c2276f502d6ad34940d1f2b907890d d74648e8c92952b1c9fdb4796f3d360e Sources: SUSE LINUX 10.0: e1f57563afd30bb0252494a010d3c0c0 SUSE LINUX 9.3: 2663aecb5e77147aca6881bd92e570bb SUSE LINUX 9.2: 9415d5fefce7c12bd381d03255ec02f1 9e6d935a4c540a5de5ff2681ee8281f1 SUSE LINUX 9.1: 4147426d68077823fa808905e10478bf f4d1da1c13fd712999a87f7736eec2eb c3ee5b82f7bb056082b3402d59b1eaed 3dc3eea2b078aa1222875ad8abd09260 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from
Mar 01, 2006
•Critical
SuSE
100
security advisorycriticalremote code executionSUSE Linux 10.0, 9.3 SUSE-SA:2006:009 Critical: GPG Code Execution
With certain handcraftable signatures GPG was returning a 0 (valid With certain handcraftable signatures GPG was returning a 0 (valid signature) when used on command-line with option --verify. signature) when used on command-line with option --verify. This only affects GPG version 1.4.x, so it only affects SUSE Linux 9.3 and 10.0. Other SUSE Linux versions are not affected. This could make auto [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: gpg,liby2util Announcement ID: SUSE-SA:2006:009 Date: Mon, 20 Feb 2006 18:00:00 +0000 Affected Products: SUSE LINUX 10.0 SUSE LINUX 9.3 Vulnerability Type: remote code execution Severity (1-10): 9 SUSE Default Package: yes Cross-References: CVE-2006-0455 Content of This Advisory: 1) Security Vulnerability Resolved: gpg incorrect signature checking Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion With certain handcraftable signatures GPG was returning a 0 (valid signature) when used on command-line with option --verify. This only affects GPG version 1.4.x, so it only affects SUSE Linux 9.3 and 10.0. Other SUSE Linux versions are not affected. This could make automated checkers, like for instance the patch file verification checker of the YaST Online Update, pass malicious patch files as correct. This is tracked by theMitre CVE ID CVE-2006-0455. Also, the YaST Online Update script signature verification had used a feature which was lost in gpg 1.4.x, making it possible to supply any kind of script which would be thought correct. This would also allow code execution. Both attacks require an attacker either manipulating a YaST Online Update mirror or manipulating the network traffic between the mirror and your machine. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes None. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv to apply the update, replacing with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.0: f1422c0264ff3e270a56d03d4b47e762 9a6f3ee339303f3efd92121dedf441aa b504c0cf0f84039018ae1ac90d2e5292 SUSE LINUX 9.3: fffa34f3034effa188cbeb942473e200 a321ab146d07c50cc69a91352ac28bf7 1215bcf8f061079dbe05b93b1d611818 Power PC Platform: SUSE LINUX 10.0: 287ef59b3aec2b9aaaba0e17a9cbba27 f0bd4524c50c5e0a5613f70393ba4489 x86-64 Platform: SUSE LINUX 10.0: edcad55c6587b9322b5895f2e1ff3760 c6b4a827e8ab4dc6d14608ceeb3e3385 SUSE LINUX 9.3: 7cd1425a429b4637b34aa675d4eeaa85 8d27157261b70a5bb51ab643d8dd1fe8 Sources: SUSE LINUX 10.0: 5098f06cba2e38aa0b5181fb3f9cd7f3 3107fb78311f00f01c484c1fa1ab26df SUSE LINUX 9.3: 026b7d74d345815de958152305ffde09 2663aecb5e77147aca6881bd92e570bb ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures providean easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from
Feb 20, 2006
•Critical
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!