PT-2007-2061 · Pgp · Pgp Desktop

Peter Winter-Smith · Published 2007-01-30 · Updated 2018-10-16 · CVE-2007-0603

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PGP Desktop versions prior to 9.5.1

Description The issue concerns the lack of validation for data objects received over specific named pipes, allowing remote authenticated users to gain privileges. This is achieved by sending a data object that represents an absolute pointer, leading to code execution at the corresponding address. The affected named pipes are related to PGPServ.exe and PGPsdkServ.exe.

Recommendations For versions prior to 9.5.1, update to version 9.5.1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2007-0603

Affected Products

Pgp Desktop

References · 12

• http://ngssoftware.com/advisories/medium-risk-vulnerability-in-pgp-desktop · Vendor Advisory
• http://secunia.com/advisories/23938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0603 · Security Note
• http://securityfocus.com/bid/22247 · Note
• http://securityfocus.com/archive/1/458137/100/0/threaded · Note
• http://osvdb.org/32969 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0025.html · Note
• http://kb.cert.org/vuls/id/102465 · Note
• http://vupen.com/english/advisories/2007/0356 · Note
• http://securitytracker.com/id?1017563 · Note
• http://securityreason.com/securityalert/2203 · Note
• http://osvdb.org/32970 · Note