WinPT User ID Spoofing Vulnerability

2007.06.14
Credit: nnposter
Risk: Medium
Local: Yes
Remote: No
CWE: CWE-Other


CVSS Base Score: 7.1/10
Impact Subscore: 6.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Complete
Availability impact: None

WinPT User ID Spoofing Vulnerability Impact: Impersonation Where: Remote Status: Unpatched Product: Windows Privacy Tray (WinPT) http://wald.intevation.org/projects/winpt Visual representation of keys in WinPT 1.2.0 is susceptible to a user ID spoofing attack using keys with large amount of data in the user IDs. In several instances the key user IDs are displayed in a fixed size window and any excessive user ID data are simply visually truncated. This allows an attacker to trick a target into using a key with additional user IDs that are hidden during certain operations, including key importing, key signing, key editing, and signature listing. This can in turn lead to unintentional encryption of sensitive information with the attacker's key instead of the legitimate key. Attack Scenario: The attacker creates a key with one or more user IDs that the target is willing to import and sign, e.g. "Attacker <attacker (at) foo (dot) org [email concealed]>". If the objective is to obtain data normally encrypted for victim (at) bar (dot) com [email concealed] then the attacker adds a user ID that looks like: Attacker <attacker (at) foo (dot) org [email concealed]>"SSSSMMMMSSSS<victim (at) bar (dot) com [email concealed]> where SSSS represents a large number of spaces (0x20) and MMMM is a bogus WinPT message. This will cause <victim (at) bar (dot) com [email concealed]> to stay hidden and the message will further strengthen user's perception that he sees all key data. Encrypting a sensitive plaintext for victim (at) bar (dot) com [email concealed] with GnuPG will use the attacker's key as long as it has been loaded into the keyring before the legitimate key: C:\>echo This is a secret | gpg -r victim (at) bar (dot) com [email concealed] -e | gpg gpg: encrypted with 1024-bit ELG-E key, ID 7F378BF7, created 2007-03-09 "Attacker <attacker (at) foo (dot) com [email concealed]>" A more detailed description including a sample key and screen shots is available in the WinPT bug repository (bug 327). The vulnerability has been identified in version 1.2.0. However, other versions may be also affected. Workaround: Do not rely on WinPT to inspect and/or import keys; use GnuPG instead. History: 3/9/07: Issue filed as bug 327 3/9/07: Issue acknowledged by the project maintainer 4/4/07: Maintainer announces an indefinite suspension of the project. 5/18/07: Request for a bug status 6/5/07: Request for a bug status 6/11/07: Public disclosure Found by: nnposter


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top