Download our in-depth report: The Ultimate Guide to IT Security VendorsNetwork security firm Foundstone said Thursday that it had discovered a significant security vulnerability in PGP, the de facto commercial encryption software.
The flaw stems from an overflow that allows the attacker to take control of the recipient's computer, elevating his or her privileges on the organization's network
According to the firm, the vulnerability could have very wide spread effects due to the trusting nature of encrypted attachments in e-mail, its relative ease of exploitation and the large amount of corporations, military and government agencies that rely on PGP encryption for secure communication.
The flaw, which Foundstone believes could be easily exploited, affects PGP Corporate Edition 7.1.0 and 7.1.1. Software maker.https://o1.qnsr.com/log/p.gif?;n=203;c=204650394;s=9477;x=7936;f=201801171506010;u=j;z=TIMESTAMP;a=20392931;e=i The attack works by encrypting a file with a public key
The attack is effective because PGP does not properly check the length of the filename. An attacker could create an encrypted document and send it to a recipient who trusts the source of the message. As the recipient decrypts the message, the file length will cause a PGP overflow and the software to crash, allowing the attacker to take control of the computer and possibly gain access to sensitive or confidential information on the network.
PGP has issued a fix for this vulnerability, available here.
PGP, which stands for "pretty good privacy," was developed as a freeware program by Phil Zimmerman in the early 90s to provide secure e-mail and file storage using a public key system, and in the past decade, has become the standard for e-mail encryption.
This is not the first time PGP has come under scrutiny for security threats. Initially, in the early 90's when the software came out, the U.S. military believed PGP's security threat was to the nation itself. On Feb. 17, 1993, the government threatened to prosecute its creator for "illegal trafficking in munitions," as U.S. export regulations classify all encryption devices as "munitions," military weapons.
Now, the focus has come on vulnerabilities as the software, bought in 1997
by Network Associates
Last month a flaw was discovered that could allow an attacker to view sensitive
information contained in emails, and in July, a flaw was discovered
in a PGP plug-in for Outlook which also allows an attacker to take over a
, and recently sold to
start-up firm PGA Corp., has had numerous flaws recently.
Last month a flaw was discovered that could allow an attacker to view sensitive information contained in emails, and in July, a flaw was discovered in a PGP plug-in for Outlook which also allows an attacker to take over a users computer.