1. CVE-Search
  2. CVE-2006-0455
ID CVE-2006-0455
Summary gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".
References
Vulnerable Configurations
  • cpe:2.3:a:gnu:privacy_guard:1.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.4:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2.2:rc1:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2.2:rc1:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.3b:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.3b:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2.4:*:*:*:*:*:*:*
CVSS
Base: 4.6 (as of 13-02-2023 - 02:16)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:L/Au:N/C:P/I:P/A:P
oval via4
accepted 2013-04-29T04:01:23.930-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".
family unix
id oval:org.mitre.oval:def:10084
status accepted
submitted 2010-07-09T03:56:16-04:00
title gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".
version 29
redhat via4
advisories
bugzilla
id 1618000
title CVE-2006-0455 security flaw
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304025
    • comment gnupg is earlier than 0:1.2.6-3
      oval oval:com.redhat.rhsa:tst:20060266001
    • comment gnupg is signed with Red Hat master key
      oval oval:com.redhat.rhsa:tst:20060266002
rhsa
id RHSA-2006:0266
released 2006-03-15
severity Important
title RHSA-2006:0266: gnupg security update (Important)
rpms
  • gnupg-0:1.2.1-15
  • gnupg-0:1.2.6-3
  • gnupg-debuginfo-0:1.2.1-15
  • gnupg-debuginfo-0:1.2.6-3
refmap via4
bid 16663
bugtraq 20060215 False positive signature verification in GnuPG
debian DSA-978
fedora
  • FEDORA-2006-116
  • FLSA-2006:185355
gentoo GLSA-200602-10
mandriva MDKSA-2006:043
mlist
  • [gnupg-announce] 20060215 False positive signature verification in GnuPG
  • [gnupg-devel] 20060215 [Announce] False positive signature verification in GnuPG
openpkg OpenPKG-SA-2006.001
osvdb 23221
secunia
  • 18845
  • 18933
  • 18934
  • 18942
  • 18955
  • 18956
  • 18968
  • 19130
  • 19249
  • 19532
sgi 20060401-01-U
slackware SSA:2006-072-02
suse
  • SUSE-SA:2006:009
  • SUSE-SA:2006:013
  • SUSE-SR:2006:005
trustix 2006-0008
ubuntu USN-252-1
vupen ADV-2006-0610
xf gnupg-gpgv-improper-verification(24744)
Last major update 13-02-2023 - 02:16
Published 15-02-2006 - 22:06
Last modified 13-02-2023 - 02:16
Back to Top