PT-2010-4958 · Pgp · Pgp Desktop

Eric R. Verheul · Published 2010-11-20 · Updated 2017-08-17 · CVE-2010-3618

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PGP Desktop versions 10.0.x through 10.0.3 SP1 PGP Desktop version 10.1.0

Description The issue is related to the improper implementation of the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages. This allows remote attackers to spoof signed data by concatenating an additional message to the end of a legitimately signed message, which is referred to as a "piggy-back" or "unsigned data injection" issue.

Recommendations For PGP Desktop versions 10.0.x through 10.0.3 SP1, update to version 10.0.3 SP2. For PGP Desktop version 10.1.0, update to version 10.1.0 SP1.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-3618

Affected Products

Pgp Desktop

References · 11

• 🔥 http://cs.ru.nl/E.Verheul/papers/Govcert/Pretty%20Good%20Piggybagging%20v1.0.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-3618 · Security Note
• https://pgp.custhelp.com/app/answers/detail/a_id/2290 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/63366 · Note
• http://symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20101118_00 · Note
• http://secunia.com/advisories/42307 · Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20101118_00 · Note
• http://securitytracker.com/id?1024760 · Note
• http://kb.cert.org/vuls/id/300785 · Note
• http://secunia.com/advisories/42293 · Note
• http://xforce.iss.net/xforce/xfdb/63366 · Note