CVE-2014-9087

What it actually does

Integer underflow in ksba_oid_to_str triggers a buffer overflow when parsing a crafted OID inside S/MIME or ECC-based OpenPGP data, leading to denial of service or potential code execution.

Why it matters to the business

Processing of crafted secure messages or keys can crash applications that rely on Libksba, interrupting encrypted email workflows and key-management operations across Linux distributions and GnuPG deployments.

How an attack unfolds

An attacker embeds a maliciously small OID length value in an S/MIME message or OpenPGP data stream, sends the data to a target that uses GnuPG or any Libksba-dependent tool, and the underflow during OID string conversion produces an out-of-bounds write.

How to fix it

Upgrade Libksba to version 1.3.2 or newer; apply the corresponding security updates released by Mageia, Debian, Ubuntu, and other distributions that package GnuPG and Libksba.

How to confirm the fix worked

Confirm that the running Libksba shared library reports version 1.3.2 or later; replay known-good and known-bad OID test vectors through GnuPG or any dependent application to verify absence of crashes.

Typical attack path

1. Craft S/MIME or OpenPGP data containing an OID with an underflow-inducing length
2. Deliver the data via email, keyserver, or file transfer to a vulnerable recipient
3. Trigger parsing of the OID inside ksba_oid_to_str
4. Induce buffer overflow resulting in crash or code execution

How to detect it

Search process crash logs and application core dumps for ksba_oid_to_str or GnuPG when handling inbound S/MIME or OpenPGP data; review mail-server and GnuPG logs for unusual OID-related errors or early terminations.

What your security team should do

• Inventory all systems that ship or link against Libksba and schedule upgrades to 1.3.2+
• Block or sandbox inbound S/MIME and OpenPGP messages until patches are deployed
• Add version checks for libksba to routine vulnerability scanning and patch compliance reports