PT-2014-4275 · Symantec · Symantec Pgp Desktop+1

Publicado 2014-04-23 · Atualizado 2014-04-24 · CVE-2014-1646

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Symantec PGP Desktop versions 10.0.x through 10.2.x Symantec Encryption Desktop Professional versions 10.3.x before 10.3.2 MP1

Description The issue is related to improper memory copy operations, which can be exploited by remote attackers using a malformed certificate. This exploitation can lead to a denial of service, resulting in a read access violation and application crash.

Recommendations For Symantec PGP Desktop versions 10.0.x through 10.2.x, update to a version outside of the affected range to resolve the issue. For Symantec Encryption Desktop Professional versions 10.3.x before 10.3.2 MP1, update to version 10.3.2 MP1 or later to fix the problem.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2014-1646

Produtos afetados

Symantec Encryption Desktop Professional

Symantec Pgp Desktop

Referências · 3

• http://securityfocus.com/bid/67016 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1646 · Nota de Segurança
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00 · Aviso do Fabricante