-----BEGIN PGP SIGNED MESSAGE-----



=============================================================================

FreeBSD-SA-00:67                                           Security Advisory

                                                                FreeBSD, Inc.



Topic:          gnupg fails to correctly verify signatures



Category:       ports

Module:         gnupg

Announced:      2000-11-10

Credits:        Jim Small 

Affects:        Ports collection prior to the correction date.

Corrected:      2000-10-18

Vendor status:  Updated version released

FreeBSD only:   NO



I.   Background



GnuPG is an implementation of the PGP digital signature/encryption

protocol.



II.  Problem Description



Versions of gnupg prior to 1.04 fail to correctly verify multiple

signatures contained in a single document. Only the first signature

encountered is actually verified, meaning that other data with invalid

signatures (e.g. data which has been tampered with by an attacker)

will not be verified, and the entire document will be treated as

having valid signatures.



The gnupg port is not installed by default, nor is it "part of

FreeBSD" as such: it is part of the FreeBSD ports collection, which

contains over 4100 third-party applications in a ready-to-install

format. The ports collections shipped with FreeBSD 3.5.1 and 4.1.1 are

vulnerable to this problem since it was discovered after the releases,

but it was corrected prior to the release of FreeBSD 4.2.



FreeBSD makes no claim about the security of these third-party

applications, although an effort is underway to provide a security

audit of the most security-critical ports.



III. Impact



Documents containing multiple signed regions of data can be corrupted

or tampered with by an attacker without detection, as long as the

first signature in the document remains valid.



IV.  Workaround



Deinstall the gnupg port/package, if you you have installed it.



V.   Solution



One of the following:



1) Upgrade your entire ports collection and rebuild the gnupg port.



2) Deinstall the old package and install a new package dated after the

correction date, obtained from the following directories:



http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/security/gnupg-1.04.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/security/gnupg-1.04.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/security/gnupg-1.04.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/security/gnupg-1.04.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/security/gnupg-1.04.tgz



3) download a new port skeleton for the gnupg port from:



http://www.freebsd.org/ports/



and use it to rebuild the port.



4) Use the portcheckout utility to automate option (3) above. The

portcheckout port is available in /usr/ports/devel/portcheckout or the

package can be obtained from:



http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz

http://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.0.4 (FreeBSD)

Comment: For info see http://www.gnupg.org



iQCVAwUBOgx6dlUuHi5z0oilAQEGaAP+KXIJlLBgF7tXXtLWcyJkhI6mAxgMyHEJ

y+9RkI22mz7etMN1Nqm22Rj1cYBO99Q35lx4qJpuGftuRV+D9P6f5FbXMp+qhw24

K1t07eQhgiiNO1y9snvvEwwWtsHiosMFyIleFdbJwXoioqNsDFcByOwbG7zoEOOU

BfDBTmKtPvQ=

=1ZMA

-----END PGP SIGNATURE-----