xfocus logo xfocus title
首页 焦点原创 安全文摘 安全工具 安全漏洞 焦点项目 焦点论坛 关于我们
English Version

PGP Desktop文件名存在缓冲溢出漏洞


发布时间:2002-09-11
更新时间:2002-09-11
严重程度:
威胁程度:读取受限文件
错误类型:边界检查错误
利用方式:客户机模式

BUGTRAQ ID:5656

受影响系统
Network Associates PGP 5.0 i
   - HP HP-UX 11.0
   - IBM AIX 4.3
   - Linux kernel 2.3
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
   - RedHat Linux 7.0
   - Sun Solaris 8.0
Network Associates PGP 5.0
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
Network Associates PGP 5.5.3 i for Windows
   - Microsoft Windows 2000 Workstation
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
Network Associates PGP 5.5.5
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
Network Associates PGP 6.0.2 i
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
Network Associates PGP 6.0.2
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
Network Associates PGP 6.5.1 i
   - HP HP-UX 11.0
   - IBM AIX 4.3
   - Linux kernel 2.3
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
   - RedHat Linux 7.0
   - Sun Solaris 8.0
Network Associates PGP 6.5.3 i for Windows
   - Microsoft Windows 2000 Workstation
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
Network Associates PGP 6.5.3
   - Microsoft Windows 2000 Workstation
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
Network Associates PGP 6.5.8
   - HP HP-UX 10.0
   - IBM AIX 4.3
   - Linux kernel 2.3
   - Microsoft Windows 2000 Workstation
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
   - RedHat Linux 7.0
   - Sun Solaris 8.0
Network Associates PGP 7.0
   - Microsoft Windows 2000 Workstation
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows ME
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0 SP1
   - Microsoft Windows NT 4.0 SP2
   - Microsoft Windows NT 4.0 SP3
   - Microsoft Windows NT 4.0 SP4
   - Microsoft Windows NT 4.0 SP5
   - Microsoft Windows NT 4.0 SP6a
Network Associates PGP 7.0.3
   - Microsoft Windows 2000 Workstation
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
Network Associates PGP 7.0.4
   - Microsoft Windows 2000 Workstation
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows NT 4.0
Network Associates PGP 7.1
Network Associates PGP 7.1.1
   - Microsoft Windows 2000 Workstation
   - Microsoft Windows 95
   - Microsoft Windows 98
   - Microsoft Windows ME
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0 SP1
   - Microsoft Windows NT 4.0 SP2
   - Microsoft Windows NT 4.0 SP3
   - Microsoft Windows NT 4.0 SP4
   - Microsoft Windows NT 4.0 SP5
   - Microsoft Windows NT 4.0 SP6a
Network Associates PGP Corporate Desktop 7.1
   - Apple MacOS 9.0
   - Microsoft Windows 2000 Workstation
   - Microsoft Windows 2000 Workstation SP1
   - Microsoft Windows 2000 Workstation SP2
   - Microsoft Windows 95 SR2
   - Microsoft Windows 98
   - Microsoft Windows 98 b
   - Microsoft Windows 98SE
   - Microsoft Windows ME
   - Microsoft Windows NT 4.0 SP4
   - Microsoft Windows NT 4.0 SP5
   - Microsoft Windows NT 4.0 SP6a
Network Associates PGP Corporate Desktop 7.1.1
Network Associates PGP Freeware 7.0.3
   - Apple MacOS 9.0
   - Microsoft Windows 2000 Workstation
   - Microsoft Windows 2000 Workstation SP1
   - Microsoft Windows 2000 Workstation SP2
   - Microsoft Windows 95 SR2
   - Microsoft Windows 98
   - Microsoft Windows 98 b
   - Microsoft Windows 98SE
   - Microsoft Windows ME
   - Microsoft Windows NT 4.0 SP4
   - Microsoft Windows NT 4.0 SP5
   - Microsoft Windows NT 4.0 SP6a
详细描述
PGP Corporate Desktop是加密数据应用程序。

PGP在处理文件名时存在一个漏洞,攻击者可以建立包含如下数据的文件名:

<196 bytes><eip><9 bytes><readable address><29 bytes>

然后使用目标用户PUBLIC KEY加密文件,当用户收到这个文件使用PGP解密的时候,可导致堆栈破坏, 产生崩溃。存在执行任意代码可能。

另外,由于在缓冲溢出发生的时候内存中的密码字段没有清空,SHELLCODE可以写成获得密码字段并传输给攻击者。

测试代码


解决方案
采用补丁程序:

Network Associates PGP 5.0 i:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 5.0:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 5.5.3 i for Windows:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 5.5.5:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 6.0.2 i:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 6.0.2:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 6.5.1 i:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 6.5.3 i for Windows:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 6.5.3:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 6.5.8:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 7.0:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP Freeware 7.0.3:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 7.0.3:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 7.0.4:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP Corporate Desktop 7.1:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 7.1:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP Corporate Desktop 7.1.1:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

Network Associates PGP 7.1.1:

Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip
http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip

相关信息
Tony Bettini <tony.bettini@foundstone.com>
参考:http://online.securityfocus.com/advisories/4450