PGP Vulnerability Opens Door to Remote Attacks
Email
Print
Flaw gives remote attackers the ability to use encrypted files to force a vulnerable machine to run arbitrary code.
Security researchers at Foundstone Inc. have discovered a serious vulnerability in PGP--the popular e-mail encryption program--that gives remote attackers the ability to use encrypted files to force a vulnerable machine to run arbitrary code. The flaw lies in the way that the Pretty Good Privacy Corporate Desktop 7.1.1 application handles encrypted files. In many instances, the application fails to check the length of the filename. As a result, PGP will crash if the user tries to encrypt or decrypt a document with an overly long filename. An attacker could exploit this fairly easily. Once he creates a filename of the specified length, he would then simply encrypt the file with the public key of the targeted user and send the file.When the user tries to decrypt the document, the filename would overflow the memory buffer set up for it and execute whatever code the attacker has included. In some cases, this condition may also reveal the users passphrase, as PGP crashes after the file is decrypted but before the passphrase is overwritten in memory, Foundstone said in its advisory, released Thursday.
