CVE-2007-0603
PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address.
- CVSS 2.0
- 7.1 HIGHAV:N/AC:H/Au:S/C:C/I:C/A:C
- EPSS
- 5.17% probability · 92th percentile
- CISA KEV
- Not listed
- Affected
- pgp/corporate desktop
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0025.html
- http://osvdb.org/32969
- http://osvdb.org/32970
- http://secunia.com/advisories/23938Vendor Advisory
- http://securityreason.com/securityalert/2203
- http://securitytracker.com/id?1017563
- http://www.kb.cert.org/vuls/id/102465US Government Resource
- http://www.ngssoftware.com/advisories/medium-risk-vulnerability-in-pgp-desktop/Vendor Advisory
- http://www.securityfocus.com/archive/1/458137/100/0/threaded
- http://www.securityfocus.com/bid/22247
- http://www.vupen.com/english/advisories/2007/0356
- http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0025.html
- http://osvdb.org/32969
- http://osvdb.org/32970
- http://secunia.com/advisories/23938Vendor Advisory
- http://securityreason.com/securityalert/2203
- http://securitytracker.com/id?1017563
- http://www.kb.cert.org/vuls/id/102465US Government Resource
- http://www.ngssoftware.com/advisories/medium-risk-vulnerability-in-pgp-desktop/Vendor Advisory
- http://www.securityfocus.com/archive/1/458137/100/0/threaded
- http://www.securityfocus.com/bid/22247
- http://www.vupen.com/english/advisories/2007/0356
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.