Windows PGP ASCII Armor Parser Vulnerability

ReportedApril 9, 2001, by @stake.

VERSIONAFFECTED

DESCRIPTION 

Using Pretty Good Privacy (PGP)versions 5.0 to 7.0.3 of Windows 2000, Windows NT, Windows Millennium (Me),andWindows 9x, a malicious attacker can wrap a specially formed ASCII armored filearound a file with arbitrary nameand contents. After parsing the armored file by using PGP, the attacker canextract the binary file. Becauseof the way that Windows OSs load the .dll files, if the extracted file is a .dllfile, the intruder can trick severalapplications into loading the .dll files and executing potentially maliciouscode. Users can obtain a more detailedadvisory from the @stakeWeb site.

VENDORRESPONSE

Thevendor, Network Associates, Inc. (NAI), hasreleased several patches to correct this vulnerability:

PGPDesktop Security 7.0.4 Hotfix 1

PGPfreeware7.0.3 Hotfix 1

CREDIT

Discoveredby ChrisAnley of @stake.