OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2003.029
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2003.029
Advisory Published:      2009-07-05 04:04 UTC

Issue Id (internal):     OpenPKG-SI-20030516.01
Issue First Created:     2003-05-16
Issue Last Modified:     2006-11-28
Issue Revision:          06


Subject Name:            GNUPG
Subject Summary:         GNU Privacy Guard
Subject Home:            http://www.gnupg.org/
Subject Versions:        * <= 1.2.1

Vulnerability Id:        CVE-2003-0255
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           local system
Attack Impact:           identity fraud

Description:
    The GNU Privacy Guard (GnuPG) [0] development team discovered [1]
    that the key validation code in GnuPG 1.2.1 and older versions does
    not properly determine the validity of keys with multiple user IDs
    and assigns the greatest validity of the most valid user ID, which
    prevents GnuPG from warning the encrypting user when a user ID does
    not have a trusted path.

References:
    [0]  http://www.gnupg.org/
    [1]  http://lists.gnupg.org/pipermail/gnupg-announce/2003q2/000268.html
    [2]  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0255
    [3]  http://www.openpkg.org/tutorial.html#regular-source
    [4]  http://www.openpkg.org/tutorial.html#regular-binary
    [5]  ftp://ftp.openpkg.org/release/1.2/UPD/gnupg-1.2.1-1.2.1.src.rpm
    [6]  ftp://ftp.openpkg.org/release/1.1/UPD/gnupg-1.0.7-1.1.1.src.rpm
    [7]  ftp://ftp.openpkg.org/release/1.2/UPD/
    [8]  ftp://ftp.openpkg.org/release/1.1/UPD/
    [9]  http://www.openpkg.org/security.html#signature


Primary Package Name:    gnupg
Primary Package Home:    http://openpkg.org/go/package/gnupg

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        1.1-SOLID         gnupg-1.0.7-1.1.0
OpenPKG Community        1.2-SOLID         gnupg-1.2.1-1.2.0
OpenPKG Community        CURRENT           gnupg-1.2.1-20030408

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        1.1-SOLID         gnupg-1.0.7-1.1.1
OpenPKG Community        1.2-SOLID         gnupg-1.2.1-1.2.1
OpenPKG Community        CURRENT           gnupg-1.2.2-20030501