Application security, Patch/Configuration Management, Vulnerability Management

Core Security: GNU Privacy Guard flaw allows phishing-like attacks

A critical flaw in the popular encryption software GNU Privacy Guard (GPG) allows attackers to launch a phishing-style attack that inserts text appearing to part of a trusted email, Core Security Technologies announced today.

That text may contain malware or lead unsuspecting users to a malicious website, Ivan Arce, CTO of Core Security, the vendor that discovered the flaw, told today.

The vulnerability, which has been patched since Feb. 20 and is corrected in the new version of GPG that was released Monday, affects email clients such as KMail, Evolution, Sylpheed, Mutt and GNUMail, said Arce.

He said there have been no reports of active exploits, but an attack is particularly worrisome because it would allow cybercriminals to use a new vector.

"The attacker can insert text in what you believe is a completely signed [encrypted] message," said Mike Yaffe, Core’s marketing director. "You insert code and say, ‘Hey go to this website,' or, 'hey, take this action.’ [The victim]has every reason to believe it’s a legitimate email."

GPG is an open-source replacement for the PGP encryption standard, according to the GNU project’s website. It lets users encrypt and sign their communications.

Click here to email reporter Dan Kaplan.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.