Data Injection Vulnerability in GnuPG
Core Security Technologies has issued an advisory about GnuPG (GnuPG and GnuPG clients unsigned data injection vulnerability
). Gerardo Richarte of Core Security Technologies has found that GnuPG and GnuPG clients are vulnerable to an unsigned data injection attack. According to the advisory:
An attacker is able to add arbitrary content to a signed message. The receiver of the message (using a mail client such as Enigmail to read the message) will not be able to distinguish the forged and the properly signed parts of the message.
The vulnerability stems from the feature of OpenPGP that allows for multiple portions of a message, some of which are signed and some of which are not signed.
The advisory stresses that this is not a cryptographic problem but a problem with how the message is displayed ot the user.
A number of applications are affected, including: GnuPG, Enigmail, Kmail, Evolution, Sylpheed, Mutt, and GnuMail.
The vulnerability has been fixed in GnuPG 1.4.7 and GPGME 1.1.4. For earlier versions, a patch is available at http://www.gnupg.org/download/
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
