'Pretty Good' Isn't Good Enough

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

Network security firm Foundstone said Thursday that it had discovered a
significant security vulnerability in PGP, the de facto commercial
encryption software.

The flaw stems from an overflow that allows the attacker to take control of
the recipient’s computer, elevating his or her privileges on the
organization’s network

According to the firm, the vulnerability could have very wide spread effects
due to the trusting nature of encrypted attachments in e-mail, its relative
ease of exploitation and the large amount of corporations, military and
government agencies that rely on PGP encryption for secure communication.

The flaw, which Foundstone believes could be easily exploited, affects PGP
Corporate Edition 7.1.0 and 7.1.1. Software maker.

The attack works by encrypting a file with a public key
and sending it to a recipient. Given the trusting nature of public key
encryption, the recipient would look at the encrypted file and attempt to
decrypt it. However, the act of decrypting the file may also allow arbitrary
code to be run on the host.

The attack is effective because PGP does not properly check the length of
the filename. An attacker could create an encrypted document and send it to
a recipient who trusts the source of the message. As the recipient decrypts
the message, the file length will cause a PGP overflow and the software to
crash, allowing the attacker to take control of the computer and possibly
gain access to sensitive or confidential information on the network.

PGP has issued a fix for this vulnerability, available here.

PGP, which stands for “pretty good privacy,” was developed as a freeware
program by Phil Zimmerman in the early 90s to provide secure e-mail and file
storage using a public key system, and in the past decade, has become the
standard for e-mail encryption.

This is not the first time PGP has come under scrutiny for security threats. Initially, in the early 90’s when the software came out, the U.S. military
believed PGP’s security threat was to the nation itself. On Feb. 17, 1993,
the government threatened to prosecute its creator for “illegal trafficking
in munitions,” as U.S. export regulations classify all encryption devices as
“munitions,” military weapons.

Now, the focus has come on vulnerabilities as the software, bought in 1997
by Network Associates , and recently sold to
start-up firm PGA Corp., has had numerous flaws recently.

Last month a flaw was discovered that could allow an attacker to view sensitive
information contained in emails, and in July, a flaw was discovered
in a PGP plug-in for Outlook which also allows an attacker to take over a
users computer.