PT-2007-4481 · Microsoft · Windows Privacy Tray
Publicado
2007-06-12
·
Atualizado
2018-10-16
·
CVE-2007-3201
CVSS v2.0
7.1
Alta
| Vetor | AV:N/AC:M/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions:
Windows Privacy Tray version 1.2.0
Description:
A visual truncation issue allows user-assisted remote attackers to install a key under the wrong user ID. This could lead to the user encrypting a victim's correspondence with an attacker-supplied key. The attack involves a key ID composed of the attacker's user ID, space characters, an invalid message, additional space characters, and the victim's user ID.
Recommendations:
For Windows Privacy Tray version 1.2.0, consider disabling the key installation feature until a patch is available to prevent the misuse of user IDs and keys. Restrict access to key management functions to minimize the risk of exploitation. Avoid using the
user ID and key ID variables in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Windows Privacy Tray