PT-2014-4276 · Symantec · Symantec Pgp Desktop+1

Published 2014-04-23 · Updated 2014-04-24 · CVE-2014-1647

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Symantec PGP Desktop versions 10.0.x through 10.2.x Symantec Encryption Desktop Professional versions 10.3.x before 10.3.2 MP1

Description The issue is related to the improper performance of block-data moves, which can be exploited by remote attackers using a malformed certificate. This exploitation can cause a denial of service, resulting in a read access violation and application crash.

Recommendations For Symantec PGP Desktop versions 10.0.x through 10.2.x, update to a version outside of the affected range to resolve the issue. For Symantec Encryption Desktop Professional versions 10.3.x before 10.3.2 MP1, update to version 10.3.2 MP1 or later to fix the problem.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-1647

Affected Products

Symantec Encryption Desktop Professional

Symantec Pgp Desktop

References · 3

• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1647 · Security Note
• http://securityfocus.com/bid/67020 · Note