发布日期：2003-05-05
更新日期：2003-05-21

受影响系统：

GNU GNU Privacy Guard 1.2.1
GNU GNU Privacy Guard 1.2
GNU GNU Privacy Guard 1.0.7
GNU GNU Privacy Guard 1.0.6
GNU GNU Privacy Guard 1.0.4
GNU GNU Privacy Guard 1.0.3b
GNU GNU Privacy Guard 1.0.3
GNU GNU Privacy Guard 1.0.2
GNU GNU Privacy Guard 1.0.1
GNU GNU Privacy Guard 1.0
EnGarde Secure Community 2.0
EnGarde Secure Community 1.0.1
EnGarde Secure Professional 1.5
EnGarde Secure Professional 1.2
EnGarde Secure Professional 1.1
GNU GNU Privacy Guard 1.0.5
    - Caldera Open Linux 2.4
    - Caldera Open Linux 2.3
    - Conectiva Linux 6.0
    - Conectiva Linux 5.1
    - Conectiva Linux 5.0
    - Conectiva Linux 4.3
    - Conectiva Linux 4.2
    - Conectiva Linux 4.1.1
    - Conectiva Linux 4.1
    - Conectiva Linux 4.0 es
    - Conectiva Linux 4.0
    - Debian Linux 2.2
    - Mandrake Linux Corporate Server 1.0.1
    - Mandrake Linux 8.1
    - Mandrake Linux 8.0
    - Mandrake Linux 7.2
    - Mandrake Linux 7.1
    - Microsoft Windows ME
    - Microsoft Windows 98
    - Microsoft Windows 95
    - RedHat Linux 7.1
    - RedHat Linux 7.0
    - RedHat Linux 6.2
    - SuSE Linux 7.1
    - SuSE Linux 7.0
    - SuSE Linux 6.4
    - SuSE Linux 6.3
    - Trustix Secure Linux 1.2
    - Trustix Secure Linux 1.1

不受影响系统：

GNU GNU Privacy Guard 1.2.2

描述：

---

BUGTRAQ  ID: 7497
CVE(CAN) ID: CVE-2003-0255

GNU Privacy Guard (GnuPG)是一款开放源代码的加密程序。

GPG没有正确判断多用户ID密钥的合法性，可能会导致发往一个可信用户的信息泄露。

对密钥只对应一用户ID不受此漏洞影响。简单举例，如果一个密钥有两个用户ID：

Alice <alice@example.com>和Alice's other address <alice@corp.example.net>

如果加密用户针对ID alice@example.com有一可信路径，那么这个ID是完全合法的，当加密alice@example.com时不会出现警告信息。

如果加密用户针对ID "alice@corp.example.net"路径不充分或路径不可信，那么这个ID不完全合法，或者说不是所有方面全合法。本来当加密其他用户ID时会出现警告信息("it is not certain this key belongs to the user named in the user ID / do you
want to encrypt to it anyway?")，但是由于这个漏洞，非法用户ID将被合法的接收并没有任何警告信息。

<*来源：David Shaw （dshaw@jabberwocky.com）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=105215110111174&w=2
*>

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* GnuPG Team提供的补丁方案：

Index: g10/trustdb.c
===================================================================
RCS file: /cvs/gnupg/gnupg/g10/trustdb.c,v
retrieving revision 1.89.2.1
diff -u -r1.89.2.1 trustdb.c
--- g10/trustdb.c    2 Oct 2002 21:56:03 -0000    1.89.2.1
+++ g10/trustdb.c    4 May 2003 01:12:38 -0000
@@ -808,16 +808,27 @@
   while (recno)
     {
       read_record (recno, &vrec, RECTYPE_VALID);
-      if ( validity < (vrec.r.valid.validity & TRUST_MASK) )
-        validity = (vrec.r.valid.validity & TRUST_MASK);
-      if ( namehash && !memcmp (vrec.r.valid.namehash, namehash, 20) )
-        break;
+      if(namehash)
+    {
+      /* If namehash is given we return the trust for that user ID
+         ONLY.  If the namehash is not found, then there is no
+         validity at all (i.e. the user ID wasn't signed). */
+      if(memcmp(vrec.r.valid.namehash,namehash,20)==0)
+        {
+          validity=(vrec.r.valid.validity & TRUST_MASK);
+          break;
+        }
+    }
+      else
+    {
+      /* If no namehash is given, we take the maximum validity
+         over all user IDs */
+      if ( validity < (vrec.r.valid.validity & TRUST_MASK) )
+        validity = (vrec.r.valid.validity & TRUST_MASK);
+    }
       recno = vrec.r.valid.next;
     }
  
-  if (recno) /* okay, use the user ID associated one */
-    validity = (vrec.r.valid.validity & TRUST_MASK);
-
   if ( (trec.r.trust.ownertrust & TRUST_FLAG_DISABLED) )
     validity |= TRUST_FLAG_DISABLED;

Index: g10/pkclist.c
===================================================================
RCS file: /cvs/gnupg/gnupg/g10/pkclist.c,v
retrieving revision 1.73.2.1
diff -u -r1.73.2.1 pkclist.c
--- g10/pkclist.c    17 Oct 2002 13:49:30 -0000    1.73.2.1
+++ g10/pkclist.c    4 May 2003 01:12:39 -0000
@@ -524,17 +524,23 @@
    return 0;

     if( !opt.batch && !rc ) {
-    char *p;
    u32 keyid[2];
-    size_t n;

    keyid_from_pk( pk, keyid);
    tty_printf( "%4u%c/%08lX %s \"",
          nbits_from_pk( pk ), pubkey_letter( pk->pubkey_algo ),
          (ulong)keyid[1], datestr_from_pk( pk ) );
-    p = get_user_id( keyid, &n );
-    tty_print_utf8_string( p, n ),
-    m_free(p);
+    /* If the pk was chosen by a particular user ID, this is the
+       one to ask about. */
+    if(pk->user_id)
+      tty_print_utf8_string(pk->user_id->name,pk->user_id->len);
+    else
+      {
+        size_t n;
+        char *p = get_user_id( keyid, &n );
+        tty_print_utf8_string( p, n );
+        m_free(p);
+      }
    tty_printf("\"\n");
         print_fingerprint (pk, NULL, 2);
    tty_printf("\n");
@@ -887,8 +893,27 @@
        }
        else {
            int trustlevel;
+            
+            /* Fill in the namehash so we can get the validity
+               for this particular UID.  If we start using it
+               in more places than here, it might be good to
+               fill this in for all PKs. */
+
+            if(pk->user_id)
+              {
+            pk->namehash=m_alloc(20);
+
+            if( pk->user_id->attrib_data )
+              rmd160_hash_buffer (pk->namehash,
+                          pk->user_id->attrib_data,
+                          pk->user_id->attrib_len);
+            else
+              rmd160_hash_buffer (pk->namehash,
+                          pk->user_id->name,
+                          pk->user_id->len );
+              }

-            trustlevel = get_validity (pk, NULL);
+            trustlevel = get_validity (pk, pk->namehash);
            if( (trustlevel & TRUST_FLAG_DISABLED) ) {
            tty_printf(_("Public key is disabled.\n") );
            }
@@ -901,8 +926,6 @@
            }
            else {
                PK_LIST r;
-                char *p;
-                size_t n;
                u32 keyid[2];

                keyid_from_pk( pk, keyid);
@@ -911,9 +934,16 @@
                       pubkey_letter( pk->pubkey_algo ),
                       (ulong)keyid[1],
                       datestr_from_pk( pk ) );
-                p = get_user_id( keyid, &n );
-                tty_print_utf8_string( p, n );
-                m_free(p);
+                if(pk->user_id)
+                  tty_print_utf8_string(pk->user_id->name,
+                            pk->user_id->len);
+                else
+                  {
+                size_t n;
+                char *p = get_user_id( keyid, &n );
+                tty_print_utf8_string( p, n );
+                m_free(p);
+                  }
                tty_printf("\"\n");

                r = m_alloc( sizeof *r );
@@ -981,6 +1011,25 @@
        }
        else if( !(rc=check_pubkey_algo2(pk->pubkey_algo, use )) ) {
        int trustlevel;
+
+        /* Fill in the namehash so we can get the validity
+           for this particular UID.  If we start using it
+           in more places than here, it might be good to
+           fill this in for all PKs. */
+
+        if(pk->user_id)
+          {
+            pk->namehash=m_alloc(20);
+
+            if( pk->user_id->attrib_data )
+              rmd160_hash_buffer (pk->namehash,
+                      pk->user_id->attrib_data,
+                      pk->user_id->attrib_len);
+            else
+              rmd160_hash_buffer (pk->namehash,
+                      pk->user_id->name,
+                      pk->user_id->len );
+          }

        trustlevel = get_validity (pk, pk->namehash);
        if( (trustlevel & TRUST_FLAG_DISABLED) ) {

厂商补丁：

GNU
---
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

GNU Upgrade Privacy Guard 1.2.2
http://www.gnupg.org/(en)/download/index.html#auto-ref-0

浏览次数：3924
严重程度：0（网友投票）