Core Security: GNU Privacy Guard flaw allows phishing-like attacks

That text may contain malware or lead unsuspecting users to a malicious website, Ivan Arce, CTO of Core Security, the vendor that discovered the flaw, told SCMagazine.com.

The vulnerability, which has been patched since 20 February and is corrected in the new version of GPG that was released Monday, affects email clients such as KMail, Evolution, Sylpheed, Mutt and GNUMail, said Arce.

He said there have been no reports of active exploits, but an attack is particularly worrisome because it would allow cybercriminals to use a new vector.

"The attacker can insert text in what you believe is a completely signed [encrypted] message," said Mike Yaffe, Core’s marketing director.

"You insert code and say, ‘Hey go to this website or, hey, take this action.’ [The victim] has every reason to believe it’s a legitimate email."

GPG is an open-source replacement for the PGP encryption standard, according to the GNU project’s website. It lets users encrypt and sign their communications.