Users should always be cautious and verify the authenticity of a message before applying the instructions given in that message. This includes patch information, software installation commands, and vulnerability workarounds. One method of ensuring the authenticity of messages is to use a secure cryptographic method. These packages generally also have information encryption capabilities. PGP has been chosen because it currently uses technology that is believed to be secure, is widely distributed, and is well supported by the Internet community.
Many Advisories contain information on available patches.
The contents of these patches should be verified by checking the supplied MD5 checksums listed in the Advisory against those created from the retrieved patches. Note that the listed MD5 checksums can only be trusted if they are protected by a verifiable digital signature. Impact System administrators or users may be misled into performing inappropriate actions such as installing programs containing security vulnerabilities, allowing intruders to gain privileged access. This signature should always be checked to validate the authenticity of the information. A tutorial on PGP is beyond the scope of this Alert, however, there is a large selection of PGP resources available on the Internet.