|
|
PGP Outlook Plug-In HEAP破坏漏洞
发布时间：2002-07-15
更新时间：2002-07-15
严重程度：高
威胁程度：普通用户访问权限
错误类型：边界检查错误
利用方式：服务器模式
BUGTRAQ ID：5202
受影响系统Network Associates Desktop Security 7.0.4
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 95
- Microsoft Windows 95 SR2
- Microsoft Windows 98
- Microsoft Windows 98SE
- Microsoft Windows ME
- Microsoft Windows NT Workstation 4.0 SP4
- Microsoft Windows NT Workstation 4.0 SP5
- Microsoft Windows NT Workstation 4.0 SP6
- Microsoft Windows NT Workstation 4.0 SP6a
Network Associates PGP Freeware 7.0.3
- Apple MacOS 9.0
- Microsoft Windows 2000 Workstation
- Microsoft Windows 2000 Workstation SP1
- Microsoft Windows 2000 Workstation SP2
- Microsoft Windows 95 SR2
- Microsoft Windows 98
- Microsoft Windows 98 b
- Microsoft Windows 98SE
- Microsoft Windows ME
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP6a
Network Associates PGP Personal Security 7.0.3
- Apple MacOS 9.0
- Microsoft Windows 2000 Workstation
- Microsoft Windows 2000 Workstation SP1
- Microsoft Windows 2000 Workstation SP2
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98SE
- Microsoft Windows ME 详细描述
一些PGP版本存在漏洞允许远程攻击者在系统上执行任意代码。
攻击者可以构建恶意格式的邮件发送给OUTLOOK用户，当OUTLOOK中的PGP进行信息解码的时候，可导致破坏HEAP中的结构，精心构造数据可导致任意命令执行。
测试代码
无
解决方案
升级程序：
Network Associates PGP Personal Security 7.0.3:
Network Associates PGP Freeware 7.0.3:
Network Associates Hotfix PGPOutlookPluginHotfix_20020710.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.04/hotfix/PGPOutlookPluginHotfix_20020710.zip
Network Associates Desktop Security 7.0.4:
Network Associates Hotfix PGPOutlookPluginHotfix_20020710.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.04/hotfix/PGPOutlookPluginHotfix_20020710.zip
相关信息
"Marc Maiffret" <marc@eeye.com>.
参考：http://online.securityfocus.com/archive/1/281531
|
