Nom du paquet
gnupg
Date
2001-11-20
Advisory ID
MDKSA-2001:053-1
Affected versions
CS1.0 i586 , 8.1 i586 , 8.0 i586 , 8.0 i586 , 7.1 i586 , 7.2 i586

Problem description

A format string vulnerability exists in gnupg 1.0.5 and previous versions which is fixed in 1.0.6. This vulnerability can be used to invoke shell commands with privileges of the currently logged-in user. Update: The /usr/bin/gpg executable was installed setuid root and setgid root. While being setuid root offers locking pages in physical memory to avoid writing sensitive material to swap and is of benefit, being setgid root provides no benefits and allows users to write to files that have group root access. This update strips the setgid bit from /usr/bin/gpg.

Updated packages

CS1.0 i586

 7c92d999d62389409b5b361fb6f6d781  1.0.1/RPMS/gnupg-1.0.6-2.2mdk.i586.rpm
f1cabc830673bcbb4211bb55dc0b83ea  1.0.1/SRPMS/gnupg-1.0.6-2.2mdk.src.rpm

8.1 i586

 94ce027aa75451a1b465e8f573e5b1e0  8.1/RPMS/gnupg-1.0.6-3.1mdk.i586.rpm
30c1821c47d751d3e1bde958bfe42d05  8.1/SRPMS/gnupg-1.0.6-3.1mdk.src.rpm

8.0 i586

 805e5899b4187fccefb5c6de7fe16306  8.0/RPMS/gnupg-1.0.6-2.1mdk.i586.rpm
2754b94d115e26cc62dae07ff7af20e7  8.0/SRPMS/gnupg-1.0.6-2.1mdk.src.rpm

8.0 i586

 8f0d25a0d7c49532590f85f22fb78b1e  ppc/8.0/RPMS/gnupg-1.0.6-2.1mdk.ppc.rpm
2754b94d115e26cc62dae07ff7af20e7  ppc/8.0/SRPMS/gnupg-1.0.6-2.1mdk.src.rpm

7.1 i586

 7c92d999d62389409b5b361fb6f6d781  7.1/RPMS/gnupg-1.0.6-2.2mdk.i586.rpm
f1cabc830673bcbb4211bb55dc0b83ea  7.1/SRPMS/gnupg-1.0.6-2.2mdk.src.rpm

7.2 i586

 932d06a4fc7f4d4c61072ece8b01c1ee  7.2/RPMS/gnupg-1.0.6-2.1mdk.i586.rpm
2754b94d115e26cc62dae07ff7af20e7  7.2/SRPMS/gnupg-1.0.6-2.1mdk.src.rpm

References