-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                  ESB-2002.336 -- eEye Security Advisory
            Remote PGP Outlook Encryption Plug-in Vulnerability
                               12 July 2002

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                NAI PGP Desktop Security 7.0.4
                        NAI PGP Personal Security 7.0.3
                        NAI PGP Freeware 7.0.3
Vendor:                 Network Associates
Operating System:       Windows
Impact:                 Execute Arbitrary Code/Commands
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

Remote PGP Outlook Encryption Plug-in Vulnerability

Release Date:
July 10, 2002

Severity:
High (Remote Code Execution)

Systems Affected:
NAI PGP Desktop Security 7.0.4
NAI PGP Personal Security 7.0.3
NAI PGP Freeware 7.0.3

Description:

The beer is still cold, the days are still long, the exploits still start as
jokes (this time over a beer with a three letter agency) and the
advisories... we'll just say, "All of your SCADA are belong to us."

A vulnerability in the NAI PGP Outlook plug-in can be exploited to remotely
execute code on any system that uses the NAI PGP Outlook plug-in’s. By
sending a carefully crafted email the message decoding functionality can be
manipulated to overwrite various heap structures pertinent to the PGP
plug-in.

This vulnerability can be exploited by a user simply selecting a “malicious”
email, the opening of attachments is not required. When the attack is
performed against a target system, malicious code will be executed within
the context of the user receiving the email. This can lead to the compromise
of the targets machine, as well as their PGP encrypted communications. It
should also be noted that because of the nature of the SMTP protocol this
vulnerability can be exploited anonymously.

Technical Description:

Exploitation:

By creating a malformed email we can overwrite a section of heap memory that
contains various data. By overwriting this section of heap with valid
addresses of an unused section in the PEB, which is the same across all NT
systems, we can walk the email parsing and eventually get to something
easily exploitable:

CALL DWORD PTR [ecx]

This pointer addresses references a function pointer list. At the time of
exploitation, an attacker controlled buffer address is the first item on the
stack. By overwriting the function pointer list pointer address with the
address of an Import table, we can call any imported function. Our current
stack will be passed into the function for parameter use. as is. The first
item on our stack is an address that points to attacker-controlled data.

By overwriting the address, with the address of the
SetUnhandledExceptionFilter() IAT entry, execution will redirect into this
address when the default exception handler is called,

After returning from SetUnhandledExceptionFilter() PGP Outlook will fail as
it crawls back down the call stack, after cycling through the exception list
it will call the DefaultExceptionFilter, which now contains the address of
our code. This of course can also be exploited silently using frame
reconstruction.

Due to the large size of an example vulnerable email we are not including it
in our advisory. We will be updating the research section of our website
with a link to an example email. http://www.eEye.com

Where do you want your secret key to go today?

Vendor Status: NAI has worked quickly to safeguard customers against this
vulnerability. They have released a patch, for the latest versions of the
PGP Outlook plug-in, to protect systems from this flaw. You may download the
patch from:
http://www.nai.com/naicommon/download/upgrade/patches/patch-pgphotfix.asp
Note: This issue does not affect PGP Corporate Desktop users.

Discover: Marc Maiffret
Exploitation: Riley Hassell

Greetings: Kasia, and the hot photographer from Inc Magazine. Phil
Zimmerman, the godfather of personal privacy, much respect.

Copyright (c) 1998-2002 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express consent of
eEye. If you wish to reprint the whole or any part of this alert in any
other medium excluding electronic medium, please e-mail alert@eEye.com for
permission.

Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There are
NO warranties with regard to this information. In no event shall the author
be liable for any damages whatsoever arising out of or in connection with
the use or spread of this information. Any use of this information is at the
user's own risk.

Feedback
Please send suggestions, updates, and comments to:

eEye Digital Security
http://www.eEye.com
info@eEye.com



- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for member emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBPS7RCih9+71yA2DNAQGDSAP+IFRNc5D/sXGIBBh3aBcL/2IKdLnlR7U8
q95wu7b9yH4yaVisPfJrd2+4nYSQaueu0zCCfaWigFWQbmz0aQ2bfDM+pv/hvED3
lvtKxqzEaZCGvp/AUpGu+fJrtPhUnOXYDHyj7aDd0QlTJBX7ga6GfRskf3LX4RJJ
JbKoUEyS8x4=
=F89y
-----END PGP SIGNATURE-----