Newsgroup: it.comp.sicurezza.pgp
Titolo: Remotely Exploitable Buffer Overflow in PGP

Foundstone Labs Advisory - 090502-PCRO
Advisory Name: Remotely Exploitable Buffer Overflow in PGP
 Release Date: September 5, 2002
  Application: PGP Corporate Desktop 7.1.1
    Platforms: Windows 2000/XP
     Severity: Remote code execution and plaintext passphrase disclosure
      Vendors: PGP Corporation (
http://www.pgp.com
)
      Authors: Tony Bettini (
tony.b...@foundstone.com
)
CVE Candidate: CAN-2002-0850
    Reference: 
http://www.foundstone.com/advisories
Overview:
In many locations where PGP handles files, the length of the filename is
not properly checked. As a result, PGP Corporate Desktop will crash if a
user attempts to encrypt or decrypt a file with a long filename. A remote
attacker may create an encrypted document, that when decrypted by a user
running PGP, would allow for remote commands to be executed on the client's
computer.
Detailed Description:
A malicious attacker could create a filename containing:
<196 bytes><eip><9 bytes><readable address><29 bytes>
The attacker would then encrypt the file using the public key of the target
user. In many cases, public keys often contain banners of the utilized PGP
client software and its associated version.
The encrypted archive could then be sent to the target user; potentially
via a Microsoft Outlook attachment. The email attachment could have a
filename such as "foryoureyesonly.pgp" or "confidential.pgp". When the
unsuspecting user decrypts the archive (either via autodecrypt or manual),
the overflow will occur if the file within the archive has a long filename.
In some cases the attacker may also obtain the passphrase of the target
user.
PGP crashes immediately after the decryption of the malicious file and
before the memory containing the passphrase is overwritten.
Vendor Response:
PGP has issued a fix for this vulnerability, it is available at:
http://www.nai.com/naicommon/download/upgrade/patches/patch-pgphotfix.asp
Foundstone would like to thank PGP for their cooperation with the
remediation of this vulnerability.
Solution:
We recommend applying the vendor patch.
Disclaimer:
The information contained in this advisory is copyright (c) 2002
Foundstone, Inc. and is believed to be accurate at the time of publishing,
but no representation of any warranty is given, express, or implied as to
its accuracy or completeness. In no event shall the author or Foundstone be
liable for any direct, indirect, incidental, special, exemplary or
consequential damages resulting from the use or misuse of this information.
This advisory may be redistributed, provided that no fee is assigned and
that the advisory is not modified in any way.

 
http://www.nai.com/naicommon/download/upgrade/patches/patch-pgphotfix.asp
________/^^^^^^^^^^^\
                      \________________________________________ <----=
Domanda: Ma dal 20 agosto 2002, la suite PGP č passata in blocco
(PGPnet/PGPfire esclusi) in mano alla PGP Corporation o sbaglio?
Come mai, allora, le hotfix vengono ancora rilasciate dalla NAI e sul
sito della PGP Corp. non si accenna al problema?
Ciao,
TJL73 con l'acqua nel cervello...
-- 
              | Cercasi cubista o lap-dancer |
Comunicazione |  bella presenza  max 35enne  |
   sociale:   |      anche  non esperta      |
              |    per nottate mozzafiato    |

 sito della PGP Corp. non si accenna al problema?
Il contratto tra NAI e PGP Corp dice che NAI e` risponsabile per supporto 
tecnico e manutenzione dei prodotti durante un periodo di "transition" 
che dura fino a 26 ottobre 2002.
Paul

qualcuno può confermarmi che affligge anche ckt 658?

 qualcuno può confermarmi che affligge anche ckt 658?
No... affligge solo la 7.1.1 NAI
Ciao,
TJL73 <tjl73ATdespammedDOTcom>
-- 
"Outlook: un buco di sicurezza con
funzionalita` di posta elettronica"