PGP Desktop 9.0.6 Denial Of Service

2008.12.28
Risk: Low
Local: Yes
Remote: No
CWE: CWE-399


CVSS Base Score: 4.9/10
Impact Subscore: 6.9/10
Exploitability Subscore: 3.9/10
Exploit range: Local
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Complete

--------------------------------------------------- Advisory: PGP Desktop 9.0.6 Denial Of Service Vulnerability. Version Affected: PGP Desktop 9.0.6 [Build 6060] (other version could be affected) Component Affected: PGPwded.sys Release Date: Release Date. 23 December ,2008 Description: PGP Desktop 's PGPweded.sys Driver does not sanitize user supplied input (IOCTL) and this lead to a Driver Collapse that propagates on the system with a BSOD. Affected IOCTL is 0x80022038. Proof-of-Concept: <a href="http://www.evilfingers.com/advisory/PGPDesktop_9_0_6_Denial_Of_Service_POC.php">Click Here</a> Credit: Giuseppe 'Evilcry' Bonfa' (Team Lead, www.EvilFingers.com / http://evilcry.netsons.org) Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There is no representation or warranties, either express or implied by or with respect to anything in this document, and shall not be liable for a ny implied warranties of merchantability or fitness for a particular purpose or for any indirect special or consequential damages. ---------------------------------------------------

References:

http://www.securitytracker.com/id?1021493
http://www.securityfocus.com/bid/32991
http://www.securityfocus.com/archive/1/archive/1/499572/100/0/threaded
http://www.milw0rm.com/exploits/7556
http://www.evilfingers.com/advisory/PGPDesktop_9_0_6_Denial_Of_Service_POC.php
http://www.evilfingers.com/advisory/PGPDesktop_9_0_6_Denial_Of_Service.php
http://secunia.com/advisories/33310
http://osvdb.org/50914


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top