Bug 156476 – app-crypt/gnupg 1.4 and 2.0 buffer overflow (CVE-2006-6169)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Rajiv Aaron Manglani (RETIRED) 2006-11-27 21:58:24 UTC]

From: 	  [e-mail]
	Subject: 	GnuPG 1.4 and 2.0 buffer overflow
	Date: 	November 27, 2006 12:13:02 PM EST
	To: 	  [e-mail]
	Cc: 	  [e-mail], [e-mail]

            GnuPG 1.4 and 2.0 buffer overflow
           ==================================

Summary
=======

While fixing a bug reported by Hugh Warrington, a buffer overflow has
been identified in all released GnuPG versions.  The current versions
1.4.5 and 2.0.0 are affected.  A small patch is provided.

Please do not send private mail in response to this message.  The
mailing list gnupg-devel is the best place to discuss this problem
(please subscribe first so you don't need moderator approval [1]).


Impact
======

When running GnuPG interactively, special crafted messages may be used
to crash gpg or gpg2.  Running gpg in batch mode, as done by all
software using gpg as a backend (e.g. mailers), is not affected by
this bug.

Exploiting this overflow seems to be possible.

gpg-agent, gpgsm, gpgv or other tools from the GnuPG suite are not
affected.



Solution
========

Apply the following patch to GnuPG.  It should apply cleanly to
current versions (1.4.5 as well as 2.0.0) but might also work for
older versions. 

2006-11-27  Werner Koch  <[e-mail]>

	* openfile.c (ask_outfile_name): Fixed buffer overflow occurring
	if make_printable_string returns a longer string.  Fixes bug 728.

--- g10/openfile.c      (revision 4348)
+++ g10/openfile.c      (working copy)
@@ -144,8 +144,8 @@

     s = _("Enter new filename");

-    n = strlen(s) + namelen + 10;
     defname = name && namelen? make_printable_string( name, namelen, 0): NULL;
+    n = strlen(s) + (defname?strlen (defname):0) + 10;
     prompt = xmalloc(n);
     if( defname )
        sprintf(prompt, "%s [%s]: ", s, defname );



Background:
===========

The code in question has been introduced on July 1, 1999 and is a
pretty obvious bug.  make_printable_string is supposed to replace
possible dangerous characters from a prompt and returns a malloced
string.  Thus this string may be longer than the orginal one; the
buffer for the prompt has only be allocated at the size of the original
string - oops.  Note, that using snprintf would not have helped in
this case.  How I wish C-90 had introduced asprintf or at least it
would be available on more platforms.

The original bug report is at https://bugs.g10code.com/gnupg/issue728 .



===
[1] See http://lists.gnupg.org/mailman/listinfo/gnupg-devel .


-- 
Werner Koch                                      <[e-mail]>
The GnuPG Experts                                http://g10code.com
Join the Fellowship and protect your Freedom!    http://www.fsfe.org

[Comment 1 Robin Johnson 2006-11-27 22:10:57 UTC]

and if you read the rest of the announcements on the relevant mailing lists, 1.4.6/2.0.1 will be out in a day or two to resolve this.

[Comment 2 Tavis Ormandy (RETIRED) 2006-11-28 01:38:26 UTC]

doesnt seem like a security issue, unless you can get someone to type in lots of (partially binary) characters.

Can anyone think of an attack using this bug?

[Comment 3 Stefan Cornelius (RETIRED) 2006-11-28 05:37:17 UTC]

where exactly do you have to type something? As I currently understand it, this can be triggered by interactively runnung gpg on a malicious file (like the one the reported attached to the upstream bug) - but I had no deep look here, since the vendor came out with this (and well, I seriously hope that they know what they are doing).

[Comment 4 Tavis Ormandy (RETIRED) 2006-11-28 07:18:56 UTC]

Ahh, I see what you mean, I hadnt read the bug.

Yes, this looks like it would be a problem then, ignore my last comment.

[Comment 5 Robin Johnson 2006-11-30 12:38:22 UTC]

upstream has 2.0.1 out, but not 1.4.6 yet.

[Comment 6 Matthias Geerdsen (RETIRED) 2006-12-05 12:34:03 UTC]

has not been fully wrangled so far... 
rating B2...

just to fill this comment field...

[Comment 7 Rajiv Aaron Manglani (RETIRED) 2006-12-06 12:10:18 UTC]

gnupg 1.4.6 is now available at http://www.gnupg.org/download/ 

[Comment 8 Alon Bar-Lev (RETIRED) 2006-12-06 13:15:23 UTC]

Done.

[Comment 9 Sune Kloppenborg Jeppesen (RETIRED) 2006-12-07 03:31:24 UTC]

Please don't close Security bugs.

This one is ready for GLSA.

[Comment 10 Raphael Marichez (Falco) (RETIRED) 2006-12-10 05:38:55 UTC]

GLSA 200612-03