MDKSA-2001:053-1
- Package name
- gnupg
- Date
- 2001-11-20
- Advisory ID
- MDKSA-2001:053-1
- Affected versions
- CS1.0 i586 , 8.1 i586 , 8.0 i586 , 8.0 i586 , 7.1 i586 , 7.2 i586
Problem description
A format string vulnerability exists in gnupg 1.0.5 and previous versions which is fixed in 1.0.6. This vulnerability can be used to invoke shell commands with privileges of the currently logged-in user. Update: The /usr/bin/gpg executable was installed setuid root and setgid root. While being setuid root offers locking pages in physical memory to avoid writing sensitive material to swap and is of benefit, being setgid root provides no benefits and allows users to write to files that have group root access. This update strips the setgid bit from /usr/bin/gpg.
Updated packages
CS1.0 i586
7c92d999d62389409b5b361fb6f6d781 1.0.1/RPMS/gnupg-1.0.6-2.2mdk.i586.rpm f1cabc830673bcbb4211bb55dc0b83ea 1.0.1/SRPMS/gnupg-1.0.6-2.2mdk.src.rpm
8.1 i586
94ce027aa75451a1b465e8f573e5b1e0 8.1/RPMS/gnupg-1.0.6-3.1mdk.i586.rpm 30c1821c47d751d3e1bde958bfe42d05 8.1/SRPMS/gnupg-1.0.6-3.1mdk.src.rpm
8.0 i586
805e5899b4187fccefb5c6de7fe16306 8.0/RPMS/gnupg-1.0.6-2.1mdk.i586.rpm 2754b94d115e26cc62dae07ff7af20e7 8.0/SRPMS/gnupg-1.0.6-2.1mdk.src.rpm
8.0 i586
8f0d25a0d7c49532590f85f22fb78b1e ppc/8.0/RPMS/gnupg-1.0.6-2.1mdk.ppc.rpm 2754b94d115e26cc62dae07ff7af20e7 ppc/8.0/SRPMS/gnupg-1.0.6-2.1mdk.src.rpm
7.1 i586
7c92d999d62389409b5b361fb6f6d781 7.1/RPMS/gnupg-1.0.6-2.2mdk.i586.rpm f1cabc830673bcbb4211bb55dc0b83ea 7.1/SRPMS/gnupg-1.0.6-2.2mdk.src.rpm
7.2 i586
932d06a4fc7f4d4c61072ece8b01c1ee 7.2/RPMS/gnupg-1.0.6-2.1mdk.i586.rpm 2754b94d115e26cc62dae07ff7af20e7 7.2/SRPMS/gnupg-1.0.6-2.1mdk.src.rpm