Input validation error in GnuPG - CVE-2014-4617

Vulnerability identifier: #VU32509

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-4617

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

GnuPG
Amazon Linux AMI
Gentoo Linux
Ubuntu
Slackware Linux
gnupg1 (Alpine package)
gnupg (Alpine package)
gnupg (Ubuntu package)
gnupg2 (Ubuntu package)

Install update from vendor's website.

GnuPG - update to 1.4.17
gnupg1 (Alpine package) - update to 1.4.17-r0
gnupg (Alpine package) - update to 2.0.24-r0
gnupg (Ubuntu package) - addressed in versions 1.4.10-2ubuntu1.6, 1.4.11-3ubuntu2.6, 1.4.14-1ubuntu2.2, 1.4.16-1ubuntu2.1
gnupg2 (Ubuntu package) - addressed in versions 2.0.14-1ubuntu1.7, 2.0.17-2ubuntu2.12.04.4, 2.0.20-1ubuntu3.1, 2.0.22-3ubuntu1.1

• http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=014b2103fcb12f261135e3954f26e9e07b39e342
• http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=11fdfcf82bd8d2b5bc38292a29876e10770f4b0a
• http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html
• http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html
• http://lists.opensuse.org/opensuse-updates/2014-07/msg00010.html
• http://secunia.com/advisories/59213
• http://secunia.com/advisories/59351
• http://secunia.com/advisories/59534
• http://secunia.com/advisories/59578
• http://www.debian.org/security/2014/dsa-2967
• http://www.debian.org/security/2014/dsa-2968
• http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
• http://www.ubuntu.com/usn/USN-2258-1

• Input validation error in GNU GnuPG
• Input validation error in gnupg (Alpine package)
• Input validation error in gnupg1 (Alpine package)
• Amazon Linux AMI update for gnupg2
• Amazon Linux AMI update for gnupg
• Gentoo update for GnuPG
• Slackware Linux update for gnupg2
• Slackware Linux update for gnupg
• Ubuntu update for gnupg, gnupg2