Synopsis

gnupg security update

Type/Severity

Security Advisory: Moderate

Topic

Updated GnuPG packages that fix a security issue is now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

GnuPG is a utility for encrypting data and creating digital signatures.

An integer overflow flaw was found in GnuPG. An attacker could create a
carefully crafted message packet with a large length that could cause GnuPG
to crash or possibly overwrite memory when opened. (CVE-2006-3746)

All users of GnuPG are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server 2 ia64
• Red Hat Enterprise Linux Server 2 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Workstation 2 ia64
• Red Hat Enterprise Linux Workstation 2 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 200502 - CVE-2006-3746 GnuPG Parse_Comment Remote Buffer Overflow

CVEs

• CVE-2006-3746

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 4

SRPM
x86_64
gnupg-1.2.6-6.x86_64.rpm	SHA-256: 68aefdefbb9dda4d3b7e1fa90e06bdcb56d829cf2b917b7c843da6837f33f087
gnupg-1.2.6-6.x86_64.rpm	SHA-256: 68aefdefbb9dda4d3b7e1fa90e06bdcb56d829cf2b917b7c843da6837f33f087
ia64
gnupg-1.2.6-6.ia64.rpm	SHA-256: 01f720c8e62b26de48792724243f25547564fbc190490ea73770da89f7d9dff8
gnupg-1.2.6-6.ia64.rpm	SHA-256: 01f720c8e62b26de48792724243f25547564fbc190490ea73770da89f7d9dff8
i386
gnupg-1.2.6-6.i386.rpm	SHA-256: 34bd0ade6a5ccefc9ee919d2c7ecb9d83b4f79aa87e76fca45a0669937ebe059
gnupg-1.2.6-6.i386.rpm	SHA-256: 34bd0ade6a5ccefc9ee919d2c7ecb9d83b4f79aa87e76fca45a0669937ebe059

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
gnupg-1.2.6-6.x86_64.rpm	SHA-256: 68aefdefbb9dda4d3b7e1fa90e06bdcb56d829cf2b917b7c843da6837f33f087
ia64
gnupg-1.2.6-6.ia64.rpm	SHA-256: 01f720c8e62b26de48792724243f25547564fbc190490ea73770da89f7d9dff8
i386
gnupg-1.2.6-6.i386.rpm	SHA-256: 34bd0ade6a5ccefc9ee919d2c7ecb9d83b4f79aa87e76fca45a0669937ebe059

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
gnupg-1.2.6-6.x86_64.rpm	SHA-256: 68aefdefbb9dda4d3b7e1fa90e06bdcb56d829cf2b917b7c843da6837f33f087
i386
gnupg-1.2.6-6.i386.rpm	SHA-256: 34bd0ade6a5ccefc9ee919d2c7ecb9d83b4f79aa87e76fca45a0669937ebe059

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
gnupg-1.2.6-6.s390x.rpm	SHA-256: 15b0d4b8a8916a18582e767da3d6918245d885391d29ff55fd7210eba807c7ce
s390
gnupg-1.2.6-6.s390.rpm	SHA-256: 124d661ca54b2bfdb3bb243ce9c9d2e4bc61751c45336d2dce2b45b97bc989b6

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
gnupg-1.2.6-6.ppc.rpm	SHA-256: 2630046d184dfa55741c87f512755b16b759ee84d63896fa2d521db20fb2ef66