CVE-2006-3082

23Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendepss 7.3%

de la publicación al arma1 días

Publicada en NVD19 jun

1ª PoC+1d

probabilidad de explotación

7.3%top 6% de las CVE

explotación observada

noninguna fuente lo reporta

1 exploit(s) público(s)

parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/28077

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157 http://seclists.org/lists/fulldisclosure/2006/May/0774.html http://seclists.org/lists/fulldisclosure/2006/May/0782.html http://seclists.org/lists/fulldisclosure/2006/May/0789.html http://secunia.com/advisories/20783 http://secunia.com/advisories/20801 http://secunia.com/advisories/20811 http://secunia.com/advisories/20829 http://secunia.com/advisories/20881 http://secunia.com/advisories/20899 http://secunia.com/advisories/20968