Security researchers at Foundstone Inc. have discovered a serious vulnerability in PGP–the popular e-mail encryption program–that gives remote attackers the ability to use encrypted files to force a vulnerable machine to run arbitrary code.
The flaw lies in the way that the Pretty Good Privacy Corporate Desktop 7.1.1 application handles encrypted files. In many instances, the application fails to check the length of the filename. As a result, PGP will crash if the user tries to encrypt or decrypt a document with an overly long filename.
An attacker could exploit this fairly easily. Once he creates a filename of the specified length, he would then simply encrypt the file with the public key of the targeted user and send the file.
When the user tries to decrypt the document, the filename would overflow the memory buffer set up for it and execute whatever code the attacker has included. In some cases, this condition may also reveal the users passphrase, as PGP crashes after the file is decrypted but before the passphrase is overwritten in memory, Foundstone said in its advisory, released Thursday.
This attack takes advantage of one of the things that makes public-key cryptography so elegant and efficient: the ready availability of users public keys. And because public keys in many cases contain data on the version of PGP in use and its associated client software, an attacker could search through the keys on a given key server and find vulnerable targets.
PGP Corporate Desktop combines several different functions in one application, including mail encryption, disk encryption and an administrative tool.
Network Associates Inc., which owned PGP Corporate Desktop until its recent sale to the newly formed PGP Corp., has issued a patch for the flaw. It is available on the NAI Web site at www.nai.com/naicommon/download/upgrade/patches/patch-pgphotfix.asp.
Related stories:
- PGP Encryption Gets New Lease on Life
- PGP Attack Leaves Mail Vulnerable