Symantec PGP Desktop OpenPGP Message Data Insertion Vulnerability
BID:44920
Info
Symantec PGP Desktop OpenPGP Message Data Insertion Vulnerability
| Bugtraq ID: | 44920 |
| Class: | Design Error |
| CVE: |
CVE-2010-3618 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Nov 17 2010 12:00AM |
| Updated: | Nov 19 2010 01:16PM |
| Credit: | Eric Verhail, Digital Security Group, Redbound University Nijmengen |
| Vulnerable: |
PGP Corporation PGP Desktop 10.1 PGP Corporation PGP Desktop 10.0.3 PGP Corporation PGP Desktop 9.8.3 PGP Corporation PGP Desktop 10.0.3 SP1 |
| Not Vulnerable: |
PGP Corporation PGP Desktop 10.1.0 SP1 PGP Corporation PGP Desktop 10.0.3 SP2 |
Discussion
Symantec PGP Desktop OpenPGP Message Data Insertion Vulnerability
Symantec PGP Desktop is prone to a vulnerability that may allow attackers to insert data into a signed message undetected.
Successful exploits will result in the application accepting a signed or encrypted OpenPGP message as valid even though the message has been modified by an attacker. This may lead to a false sense of security.
Symantec PGP Desktop 10.0.3, 10.1.0, and prior are vulnerable for Windows and Mac OS X.
NOTE: This issue is only a problem on Windows versions when the right-click shortcut menu option 'Decrypt/Verify File' is used.
NOTE: This issue is only a problem on OS X versions when handling encrypted data alongside encrypted and signed data when the 'Decrypt/Verify File' option is used either through the right-click shortcut menu, or directly through PGP Desktop.
Symantec PGP Desktop is prone to a vulnerability that may allow attackers to insert data into a signed message undetected.
Successful exploits will result in the application accepting a signed or encrypted OpenPGP message as valid even though the message has been modified by an attacker. This may lead to a false sense of security.
Symantec PGP Desktop 10.0.3, 10.1.0, and prior are vulnerable for Windows and Mac OS X.
NOTE: This issue is only a problem on Windows versions when the right-click shortcut menu option 'Decrypt/Verify File' is used.
NOTE: This issue is only a problem on OS X versions when handling encrypted data alongside encrypted and signed data when the 'Decrypt/Verify File' option is used either through the right-click shortcut menu, or directly through PGP Desktop.
Exploit / POC
Symantec PGP Desktop OpenPGP Message Data Insertion Vulnerability
To exploit this issue remotely, an attacker can use readily available network utilities. An attacker would need local interactive access to the affected computer to exploit this issue locally.
To exploit this issue remotely, an attacker can use readily available network utilities. An attacker would need local interactive access to the affected computer to exploit this issue locally.
Solution / Fix
Symantec PGP Desktop OpenPGP Message Data Insertion Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Symantec PGP Desktop OpenPGP Message Data Insertion Vulnerability
References:
References:
- 'Piggy-Back' Vulnerability in PGP Desktop (Symantec)
- Parsing vulnerabilities in PGP Desktop (Eric Verheul)
- Symantec Homepage (Symantec Corp.)
- Security Advisories Relating to Symantec Products - PGP Desktop Unsigned Data In (Symantec)
- Vulnerability Note VU#300785 PGP Desktop unsigned data injection vulnerability (US-CERT)