PT-2007-4481 · Microsoft · Windows Privacy Tray

Published 2007-06-12 · Updated 2018-10-16 · CVE-2007-3201

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Windows Privacy Tray version 1.2.0

Description: A visual truncation issue allows user-assisted remote attackers to install a key under the wrong user ID. This could lead to the user encrypting a victim's correspondence with an attacker-supplied key. The attack involves a key ID composed of the attacker's user ID, space characters, an invalid message, additional space characters, and the victim's user ID.

Recommendations: For Windows Privacy Tray version 1.2.0, consider disabling the key installation feature until a patch is available to prevent the misuse of user IDs and keys. Restrict access to key management functions to minimize the risk of exploitation. Avoid using the user ID and key ID variables in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-3201

Affected Products

Windows Privacy Tray

References · 8

• 🔥 http://securityfocus.com/bid/24412 · Exploit
• 🔥 https://exploit-db.com/exploits/30169 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3201 · Security Note
• http://wald.intevation.org/tracker/index.php?func=detail&aid=327&group_id=14&atid=138 · Note
• http://securityfocus.com/archive/1/471045/100/0/threaded · Note
• http://securityreason.com/securityalert/2791 · Note
• http://osvdb.org/41727 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34813 · Note