PGP Outlook Plug-In Heap Corruption Vulnerability

Bugtraq ID:	5202
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 11 2002 12:00AM
Updated:	Jul 11 2002 12:00AM
Credit:	Discovery credited to "Marc Maiffret" <[email protected]>.
Vulnerable:	Network Associates PGP Personal Security 7.0.3 - Apple Mac OS 9 9.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME Network Associates PGP Freeware 7.0.3 - Apple Mac OS 9 9.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 98 b - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 Network Associates Desktop Security 7.0.4 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4
Not Vulnerable:

PGP Outlook Plug-In Heap Corruption Vulnerability

A vulnerability has been reported for some versions of PGP that may allow a remote attacker to execute arbitrary code on the vulnerable system. It is possible for an attacker to craft a specially formatted email such that the message decoding functionality of the Outlook Plug-in can be manipulated to overwrite various structures existing on the heap.

This may allow an attacker to execute malicious supplied code on the target system.

PGP Outlook Plug-In Heap Corruption Vulnerability

References: