Multiple vulnerabilities in GNU GnuPG

1) Use-after-free

EUVDB-ID: #VU30593

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-1606

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing a crafted keyring file. A remote attackers can cause a denial of service (invalid read and use-after-free).

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 2.1.2.

Vulnerable software versions

GnuPG: 2.1.0 - 2.1.1

External links

http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=f0f71a721ccd7ab9e40b8b6b028b59632c0cc648
http://www.debian.org/security/2015/dsa-3184
http://www.openwall.com/lists/oss-security/2015/02/13/14
http://www.openwall.com/lists/oss-security/2015/02/14/6
http://www.securitytracker.com/id/1031876
http://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU30594

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-1607

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.

kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges."

Mitigation

Install update from vendor's website.

Vulnerable software versions

GnuPG: 2.1.0 - 2.1.1

External links

http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=2183683bd633818dd031b090b5530951de76f392
http://www.openwall.com/lists/oss-security/2015/02/13/14
http://www.openwall.com/lists/oss-security/2015/02/14/6
http://www.securityfocus.com/bid/72610
http://www.ubuntu.com/usn/usn-2554-1/
http://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html
http://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000361.html
http://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000362.html
http://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.