CVE-2007-1263 Security feature bypass in n/a
Attackers can forge OpenPGP message contents without detection due to lack of visual distinction between signed and unsigned parts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2007-1263?
CVE-2007-1263 is a medium-severity vulnerability in n/a, published on 6 Mar 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
Which versions are affected by CVE-2007-1263?
It affects 2 products.
Linux distribution packages (24)
gnupg Red Hat:enterprise_linux:2.1::as | All versions | 0:1.0.7-21 |
gnupg Red Hat:enterprise_linux:2.1::aw | All versions | 0:1.0.7-21 |
gnupg Red Hat:enterprise_linux:2.1::es | All versions | 0:1.0.7-21 |
gnupg Red Hat:enterprise_linux:2.1::ws | All versions | 0:1.0.7-21 |
gnupg Red Hat:enterprise_linux:3::as | All versions | 0:1.2.1-20 |
gnupg-debuginfo Red Hat:enterprise_linux:3::as | All versions | 0:1.2.1-20 |
gnupg Red Hat:enterprise_linux:3::desktop | All versions | 0:1.2.1-20 |
gnupg-debuginfo Red Hat:enterprise_linux:3::desktop | All versions | 0:1.2.1-20 |
gnupg Red Hat:enterprise_linux:3::es | All versions | 0:1.2.1-20 |
gnupg-debuginfo Red Hat:enterprise_linux:3::es | All versions | 0:1.2.1-20 |
gnupg Red Hat:enterprise_linux:3::ws | All versions | 0:1.2.1-20 |
gnupg-debuginfo Red Hat:enterprise_linux:3::ws | All versions | 0:1.2.1-20 |
gnupg Red Hat:enterprise_linux:4::as | All versions | 0:1.2.6-9 |
gnupg-debuginfo Red Hat:enterprise_linux:4::as | All versions | 0:1.2.6-9 |
gnupg Red Hat:enterprise_linux:4::desktop | All versions | 0:1.2.6-9 |
gnupg-debuginfo Red Hat:enterprise_linux:4::desktop | All versions | 0:1.2.6-9 |
gnupg Red Hat:enterprise_linux:4::es | All versions | 0:1.2.6-9 |
gnupg-debuginfo Red Hat:enterprise_linux:4::es | All versions | 0:1.2.6-9 |
gnupg Red Hat:enterprise_linux:4::ws | All versions | 0:1.2.6-9 |
gnupg-debuginfo Red Hat:enterprise_linux:4::ws | All versions | 0:1.2.6-9 |
gnupg Red Hat:enterprise_linux:5::client | All versions | 0:1.4.5-13 |
gnupg-debuginfo Red Hat:enterprise_linux:5::client | All versions | 0:1.4.5-13 |
gnupg Red Hat:enterprise_linux:5::server | All versions | 0:1.4.5-13 |
gnupg-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:1.4.5-13 |
Products include Gnu Gpgme, Gnupg Gnupg.
How do I fix CVE-2007-1263?
Upgrade to a fixed version.
Is CVE-2007-1263 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-1263 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as DEBIAN-CVE-2007-1263, DSA-1266-1, GHSA-mx49-25fh-66c8, RHSA-2007:0106, RHSA-2007:0107.