PGP Desktop文件名存在缓冲溢出漏洞发布时间:2002-09-11 更新时间:2002-09-11 严重程度:中 威胁程度:读取受限文件 错误类型:边界检查错误 利用方式:客户机模式 BUGTRAQ ID:5656 受影响系统 Network Associates PGP 5.0 i详细描述 PGP Corporate Desktop是加密数据应用程序。 PGP在处理文件名时存在一个漏洞,攻击者可以建立包含如下数据的文件名: <196 bytes><eip><9 bytes><readable address><29 bytes> 然后使用目标用户PUBLIC KEY加密文件,当用户收到这个文件使用PGP解密的时候,可导致堆栈破坏, 产生崩溃。存在执行任意代码可能。 另外,由于在缓冲溢出发生的时候内存中的密码字段没有清空,SHELLCODE可以写成获得密码字段并传输给攻击者。 测试代码 无 解决方案 采用补丁程序: Network Associates PGP 5.0 i: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 5.0: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 5.5.3 i for Windows: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 5.5.5: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 6.0.2 i: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 6.0.2: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 6.5.1 i: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 6.5.3 i for Windows: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 6.5.3: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 6.5.8: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 7.0: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP Freeware 7.0.3: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 7.0.3: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 7.0.4: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP Corporate Desktop 7.1: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 7.1: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP Corporate Desktop 7.1.1: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip Network Associates PGP 7.1.1: Network Associates Hotfix PGPhotfix_OutlookLFN_20020828.zip http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/PGPhotfix_OutlookLFN_20020828.zip 相关信息 Tony Bettini <tony.bettini@foundstone.com> 参考:http://online.securityfocus.com/advisories/4450 |