PT-2013-1667 · Symantec · Symantec Pgp Desktop+1

Published 2013-02-18 · Updated 2013-02-18 · CVE-2012-4351

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec PGP Desktop versions 10.x Symantec Encryption Desktop version 10.3.0 before MP1

Description The issue is related to an integer overflow in the pgpwded.sys component. This allows local users to gain privileges via a crafted application.

Recommendations For Symantec PGP Desktop versions 10.x, update to a version that addresses the integer overflow issue in pgpwded.sys. For Symantec Encryption Desktop version 10.3.0 before MP1, apply the MP1 patch to resolve the issue.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2012-4351

Affected Products

Symantec Encryption Desktop

Symantec Pgp Desktop

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-4351 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2013&suid=20130213_00 · Vendor Advisory
• http://securityfocus.com/bid/57170 · Note