Vulnerabilities > CVE-2001-0522 - Unspecified vulnerability in GNU Privacy Guard 7.1/7.2/8.0

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
gnu
nessus
exploit available
NVD
Published: 2001-08-14
Updated: 2024-11-20

Summary

Format string vulnerability in Gnu Privacy Guard (aka GnuPG or gpg) 1.05 and earlier can allow an attacker to gain privileges via format strings in the original filename that is stored in an encrypted file.

Vulnerable Configurations

Part Description Count
Application
Gnu
3

Exploit-Db

descriptionGNU Privacy Guard 1.0.x Format String Vulnerability. CVE-2001-0522. Remote exploits for multiple platform
idEDB-ID:20889
last seen2016-02-02
modified2001-05-29
published2001-05-29
reporterfish stiqz
sourcehttps://www.exploit-db.com/download/20889/
titleGNU Privacy Guard 1.0.x - Format String Vulnerability

Nessus

  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2001-053.NASL
    descriptionA format string vulnerability exists in gnupg 1.0.5 and previous versions which is fixed in 1.0.6. This vulnerability can be used to invoke shell commands with privileges of the currently logged-in user. Update : The /usr/bin/gpg executable was installed setuid root and setgid root. While being setuid root offers locking pages in physical memory to avoid writing sensitive material to swap and is of benefit, being setgid root provides no benefits and allows users to write to files that have group root access. This update strips the setgid bit from /usr/bin/gpg.
    last seen2020-06-01
    modified2020-06-02
    plugin id13870
    published2004-07-31
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/13870
    titleMandrake Linux Security Advisory : gnupg (MDKSA-2001:053-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-061.NASL
    descriptionThe version of GnuPG (GNU Privacy Guard, an OpenPGP implementation) as distributed in Debian GNU/Linux 2.2 suffers from two problems : - fish stiqz reported on bugtraq that there was a printf format problem in the do_get() function: it printed a prompt which included the filename that was being decrypted without checking for possible printf format attacks. This could be exploited by tricking someone into decrypting a file with a specially crafted filename. - The second bug is related to importing secret keys: when gnupg imported a secret key it would immediately make the associated public key fully trusted which changes your web of trust without asking for a confirmation. To fix this you now need a special option to import a secret key. Both problems have been fixed in version 1.0.6-0potato1.
    last seen2020-06-01
    modified2020-06-02
    plugin id14898
    published2004-09-29
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/14898
    titleDebian DSA-061-1 : gnupg - printf format attack

Redhat

advisories
rhsa
idRHSA-2001:073

References