GnuPG "do_uncompress ()" infinite loop Denial of Service Vulnerability

GnuPG "do_uncompress ()" infinite loop Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
GnuPG 2.0.x
GnuPG 1.4.x
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2014-4617
 
GnuPG is a PGP encryption, decryption, and signature Tool Based on OpenPGP standards.
 
In versions earlier than GnuPG 1.4.17 and 2.0.24, the "do_uncompress ()" function (g10/compress. c) has an error. Attackers can exploit this vulnerability to trigger an infinite loop through specially crafted messages, resulting in DOS.
 
<* Source: Olivier Levillain

Link: http://secunia.com/advisories/59422/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
GnuPG
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
GnuPG:
Http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html
Http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html
 
Olivier Levillain:
Http://www.openwall.com/lists/oss-security/2014/06/24/10

This article permanently updates the link address: