[security-alerts] FW: [SA20783] GnuPG "parse-packet.c" Denial of Service Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> GnuPG "parse-packet.c" Denial of Service Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA20783
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/20783/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> DoS
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> GnuPG / gpg 1.4.x
> http://secunia.com/product/8087/
> 
> DESCRIPTION:
> A vulnerability has been reported in GnuPG, which potentially can be
> exploited by malicious people to cause a DoS (Denial of Service).
> 
> The vulnerability is cause due to an input validation error within
> "parse-packet.c" when handling the length of a message packet. This
> can be exploited to cause gpg to consume large amount of memory or
> crash via an overly large packet length in a message packet. This can
> be further exploited to cause an integer overflow which leads to a
> possible memory corruption that crashes gpg.
> 
> Successful exploitation requires that the "--no-armor" option is
> used.
> 
> The vulnerability has been reported in version 1.4.3 and in
> development version 1.9.20. Prior versions may also be affected.
> 
> SOLUTION:
> The vulnerability has been fixed in the CVS repositories.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Evgeny Legerov
> 
> ORIGINAL ADVISORY:
> http://seclists.org/lists/fulldisclosure/2006/May/0774.html
> http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packe
> t.c?rev=4157&r1=4141&r2=4157
>