CVE-2006-0049

Description

gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 4.48% Top 15%

Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory sgi.com Vendor Advisory slackware.com Vendor Advisory securityfocus.com Vendor Advisory trustix.org Vendor Advisory suse.de Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory debian.org Vendor Advisory gnupg.org Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
https://usn.ubuntu.com/264-1/	vendor advisory
http://secunia.com/advisories/19249	third party advisory
http://www.vupen.com/english/advisories/2006/0915	vdb entry
http://www.redhat.com/support/errata/RHSA-2006-0266.html	vendor advisory
ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U	vendor advisory
http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html	mailing list patch vendor advisory
http://securityreason.com/securityalert/450	third party advisory
http://secunia.com/advisories/19232	third party advisory
http://www.osvdb.org/23790	vdb entry patch
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.476477	vendor advisory
http://secunia.com/advisories/19173	third party advisory patch vendor advisory
http://www.securityfocus.com/archive/1/433931/100/0/threaded	vendor advisory
http://www.securityfocus.com/bid/17058	vdb entry patch
http://securityreason.com/securityalert/568	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10063	vdb entry signature
http://secunia.com/advisories/19287	third party advisory
http://www.trustix.org/errata/2006/0014	vendor advisory
http://securitytracker.com/id?1015749	vdb entry patch
http://secunia.com/advisories/19532	third party advisory
http://lists.suse.de/archive/suse-security-announce/2006-Mar/0003.html	vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200603-08.xml	patch vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/25184	vdb entry
http://secunia.com/advisories/19234	third party advisory
http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00021.html	vendor advisory
http://secunia.com/advisories/19197	third party advisory
http://secunia.com/advisories/19244	third party advisory
http://secunia.com/advisories/19203	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:055	vendor advisory
http://www.securityfocus.com/archive/1/427324/100/0/threaded	mailing list
http://secunia.com/advisories/19231	third party advisory
http://www.debian.org/security/2006/dsa-993	patch vendor advisory

Frequently Asked Questions

What is the severity of CVE-2006-0049?: CVE-2006-0049 has been scored as a medium severity vulnerability.
How to fix CVE-2006-0049?: To fix CVE-2006-0049, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-0049 being actively exploited in the wild?: It is possible that CVE-2006-0049 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~4% probability that this vulnerability will be exploited by malicious actors in the next 30 days.