That text may contain malware or lead unsuspecting users to a malicious website, Ivan Arce, CTO of Core Security, the vendor that discovered the flaw, told SCMagazine.com.
The vulnerability, which has been patched since 20 February and is corrected in the new version of GPG that was released Monday, affects email clients such as KMail, Evolution, Sylpheed, Mutt and GNUMail, said Arce.
He said there have been no reports of active exploits, but an attack is particularly worrisome because it would allow cybercriminals to use a new vector.
"The attacker can insert text in what you believe is a completely signed [encrypted] message," said Mike Yaffe, Core’s marketing director.
"You insert code and say, ‘Hey go to this website or, hey, take this action.’ [The victim] has every reason to believe it’s a legitimate email."
GPG is an open-source replacement for the PGP encryption standard, according to the GNU project’s website. It lets users encrypt and sign their communications.
Core Security: GNU Privacy Guard flaw allows phishing-like attacks
By Dan Kaplan on Mar 9, 2007 12:51AM
A critical flaw in the popular encryption software GNU Privacy Guard (GPG) allows attackers to launch a phishing-style attack that inserts text appearing to part of a trusted email, Core Security Technologies announced today.
Got a news tip for our journalists? Share it with us anonymously here.