GNU Privacy Guard flaw allows phishing-like attacks

A critical flaw in the popular encryption software GNU Privacy Guard (GPG) allows attackers to launch a phishing-style attack that inserts text appearing to part of a trusted email, Core Security Technologies announced today. That text may contain malware or lead unsuspecting users to a malicious website, Ivan Arce, CTO of Core Security, the vendor that discovered the flaw, told SCMagazine.com today.

The vulnerability, which has been patched since Feb. 20 and is corrected in the new version of GPG that was released Monday, affects email clients such as KMail, Evolution, Sylpheed, Mutt and GNUMail, said Arce.

He said there have been no reports of active exploits, but an attack is particularly worrisome because it would allow cybercriminals to use a new vector.

"The attacker can insert text in what you believe is a completely signed (encrypted) message," said Mike Yaffe, Core’s marketing director. "You insert code and say, ‘Hey go to this website or, hey, take this action.’ (The victim) has every reason to believe it’s a legitimate email."