PGP Passphrase Cache Expiration Vulnerability
BID:5318
Info
PGP Passphrase Cache Expiration Vulnerability
| Bugtraq ID: | 5318 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 25 2002 12:00AM |
| Updated: | Jul 25 2002 12:00AM |
| Credit: | Vulnerability discovery credited to <[email protected]>. |
| Vulnerable: |
Network Associates PGP 7.1 Network Associates PGP 7.0.4 |
| Not Vulnerable: | |
Discussion
PGP Passphrase Cache Expiration Vulnerability
Pretty Good Privacy is the general-purpose encryption application distributed and maintained by Network Associates. This problem affects users of the software on the Microsoft Windows platforms.
PGP may not expire cached passphrases after the user-specified amount of time. Additionally, cached passphrases may be stored in memory until a user terminates their session on a system, which could potentially result in an application recovering the passphrase from system memory. This could result in a compromise of the integrity of information encrypted by a user of PGP.
It should be noted that this vulnerability is present only with the most current patches applied to PGP 7.0.4.
Pretty Good Privacy is the general-purpose encryption application distributed and maintained by Network Associates. This problem affects users of the software on the Microsoft Windows platforms.
PGP may not expire cached passphrases after the user-specified amount of time. Additionally, cached passphrases may be stored in memory until a user terminates their session on a system, which could potentially result in an application recovering the passphrase from system memory. This could result in a compromise of the integrity of information encrypted by a user of PGP.
It should be noted that this vulnerability is present only with the most current patches applied to PGP 7.0.4.
Exploit / POC
PGP Passphrase Cache Expiration Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
PGP Passphrase Cache Expiration Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PGP Passphrase Cache Expiration Vulnerability
References:
References: