News
Vigil@nce - GnuPG: database corruption via a public key
January 2013 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can create a malformed public key, and can invite a
GnuPG user to import it, in order to stop the application, or to
corrupt the keyring database.
Impacted products: GnuPG, MES, Mandriva Linux
Severity: 1/4
Creation date: 02/01/2013
DESCRIPTION OF THE VULNERABILITY
The GnuPG software uses a database (keyring) to store keys.
Users can import public keys coming from other users. However, if
the file storing the key is malformed, an error occurs in GnuPG.
This error can stop GnuPG, or can corrupt the database.
An attacker can therefore create a malformed public key, and can
invite a GnuPG user to import it, in order to stop the
application, or to corrupt the keyring database.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/GnuPG-database-corruption-via-a-public-key-12275
