The Register® — Biting the hand that feeds IT

PGP app yields remote root on Windows

Patch early, patch often

Free whitepaper – PowerEdge M610 technical guidebook

A curious flaw in a PGP application's handling of file names could allow an attacker to own a remote Windows machine with a malicious, encrypted archive.

File names over 200 characters in length will cause a buffer overflow, which, if exploited properly, could allow running arbitrary code on the target machine.

A typical attack would involve sending an encrypted archive to a victim via email. The archive itself would have a reasonably short name to avoid suspicion. But within it would be an encrypted file with a name exceeding 200 characters which would cause the desired overflow.

The flaw affects PGP Corporate Desktop 7.1.x. for Windows. A patch has been developed by former PGP owner Networks Associates, and is available here. ®

Free whitepaper – Power distribution systems for the Dell PowerEdge M1000e Modular Server Enclosure

Don’t Miss

SunSun's surviving staff hit with 'motivation' missive

Exclusive Code: Your solace, our savior

Ubuntu teaser Ubuntu's Karmic Koala bares fangs at Windows 7

Review Shuttleworthian scrap

AppleChange your views: OS X tags exploited

Mac Secrets Apple windows insider

JavaSun preps cell-phone Java plan for netbooks

OpenWorld 09 Modules not globules