National Cyber-Alert System

Vulnerability Summary for CVE-2007-0603

Overview

PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#102465

Name: VU#102465

Hyperlink:http://www.kb.cert.org/vuls/id/102465

External Source: BUGTRAQ

Name: 20070125 Medium Risk Vulnerability in PGP Desktop

Type: Advisory

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/458137/100/0/threaded

External Source: MISC

Name: http://www.ngssoftware.com/advisories/medium-risk-vulnerability-in-pgp-desktop/

Type: Advisory

Hyperlink:http://www.ngssoftware.com/advisories/medium-risk-vulnerability-in-pgp-desktop/

External Source: SECUNIA

Name: 23938

Type: Advisory

Hyperlink:http://secunia.com/advisories/23938

External Source: OSVDB

Name: 32970

Hyperlink:http://osvdb.org/32970

External Source: OSVDB

Name: 32969

Hyperlink:http://osvdb.org/32969

External Source: VULNWATCH

Name: 20070125 Medium Risk Vulnerability in PGP Desktop

Hyperlink:http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0025.html

External Source: BID

Name: 22247

Hyperlink:http://www.securityfocus.com/bid/22247

External Source: VUPEN

Name: ADV-2007-0356

Hyperlink:http://www.frsirt.com/english/advisories/2007/0356

External Source: SECTRACK

Name: 1017563

Hyperlink:http://securitytracker.com/id?1017563

External Source: SREASON

Name: 2203

Hyperlink:http://securityreason.com/securityalert/2203