CVE-2006-0455

Public Exploit

Description

gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".

4.6

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 1.91% Top 20%

Vendor Advisory trustix.org Vendor Advisory openpkg.org Vendor Advisory novell.com Vendor Advisory redhat.com Vendor Advisory novell.com Vendor Advisory sgi.com Vendor Advisory fedoranews.org Vendor Advisory slackware.com Vendor Advisory securityfocus.com Vendor Advisory novell.com Vendor Advisory gentoo.org Vendor Advisory debian.org Vendor Advisory ubuntu.com Vendor Advisory mandriva.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory vupen.com

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/bid/16663	exploit vdb entry patch
http://secunia.com/advisories/18956	third party advisory patch vendor advisory
http://www.trustix.org/errata/2006/0008	vendor advisory
http://marc.info/?l=gnupg-devel&m=113999098729114&w=2	mailing list
http://www.openpkg.org/security/OpenPKG-SA-2006.001-gnupg.html	vendor advisory
http://secunia.com/advisories/19249	third party advisory vendor advisory
http://www.novell.com/linux/security/advisories/2006_05_sr.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2006-0266.html	vendor advisory
http://www.novell.com/linux/security/advisories/2006_13_gpg.html	vendor advisory
ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U	vendor advisory
http://www.securityfocus.com/archive/1/425289/100/0/threaded	mailing list
http://secunia.com/advisories/18934	third party advisory patch vendor advisory
http://fedoranews.org/updates/FEDORA-2006-116.shtml	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/24744	vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10084	vdb entry signature
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.476477	patch vendor advisory
http://www.securityfocus.com/archive/1/433931/100/0/threaded	vendor advisory
http://secunia.com/advisories/18955	third party advisory patch vendor advisory
http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html	mailing list
http://www.novell.com/linux/security/advisories/2006_09_gpg.html	patch vendor advisory
http://secunia.com/advisories/19130	third party advisory vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200602-10.xml	patch vendor advisory
http://secunia.com/advisories/19532	third party advisory vendor advisory
http://secunia.com/advisories/18933	third party advisory patch vendor advisory
http://www.us.debian.org/security/2006/dsa-978	patch vendor advisory
http://www.osvdb.org/23221	vdb entry
http://www.ubuntu.com/usn/usn-252-1	vendor advisory
http://secunia.com/advisories/18968	third party advisory patch vendor advisory
http://secunia.com/advisories/18845	third party advisory vendor advisory
http://secunia.com/advisories/18942	third party advisory patch vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:043	vendor advisory
http://www.vupen.com/english/advisories/2006/0610	vdb entry vendor advisory

Frequently Asked Questions

What is the severity of CVE-2006-0455?: CVE-2006-0455 has been scored as a medium severity vulnerability.
How to fix CVE-2006-0455?: To fix CVE-2006-0455, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-0455 being actively exploited in the wild?: It is possible that CVE-2006-0455 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.