| Vulnerability Name: | CVE-2009-0681 (CCN-49867) | ||||||||
| Assigned: | 2009-04-13 | ||||||||
| Published: | 2009-04-13 | ||||||||
| Updated: | 2018-10-10 | ||||||||
| Summary: | PGP Desktop before 9.10 allows local users to (1) cause a denial of service (crash) via a crafted IOCTL request to pgpdisk.sys, and (2) cause a denial of service (crash) and execute arbitrary code via a crafted IRP in an IOCTL request to pgpwded.sys. | ||||||||
| CVSS v3 Severity: | 4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
| ||||||||
| CVSS v2 Severity: | 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C) 5.3 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
1.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-20 | ||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Mon Apr 13 2009 - 10:38:47 CDT [Suspected Spam][Positive Technologies SA 2009-01] PGP Desktop Pgpdisk.sys And Pgpwded.sys Multiple Vulnerabilities Source: MITRE Type: CNA CVE-2009-0681 Source: MISC Type: Patch http://en.securitylab.ru/lab/PT-2009-01 Source: CCN Type: SA33310 PGP Desktop PGPwded.sys Driver Denial of Service Source: CCN Type: SECTRACK ID: 1022034 PGP Desktop IOCTL Validation Flaws in Pgpdisk.sys and Pgpwded.sys Let Local Users Gain Elevated Privileges Source: BUGTRAQ Type: UNKNOWN 20090413 [Suspected Spam][Positive Technologies SA 2009-01] PGP Desktop Pgpdisk.sys And Pgpwded.sys Multiple Vulnerabilities Source: CCN Type: BID-34490 PGP Desktop 'pgpdisk.sys' Local Denial of Service Vulnerability Source: SECTRACK Type: UNKNOWN 1022034 Source: XF Type: UNKNOWN pgpdesktop-pgpdisk-dos(49867) Source: CCN Type: PGP Web site PGP Desktop 9.10 - Resolved Issues Source: MISC Type: Vendor Advisory https://pgp.custhelp.com/cgi-bin/pgp.cfg/php/enduser/std_adp.php?p_faqid=1014&p_topview=1 | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Vulnerability Name: | CVE-2009-0681 (CCN-49868) | ||||||||
| Assigned: | 2009-04-13 | ||||||||
| Published: | 2009-04-13 | ||||||||
| Updated: | 2009-04-13 | ||||||||
| Summary: | PGP Desktop could allow a local attacker to execute arbitrary code on the system, caused by the improper validation of data by the IOCTL handler in the pgpwded.sys driver. By sending a specially-crafted IRP in an IOCTL request, a local attacker could exploit this vulnerability to execute arbitrary code on the system with SYSTEM level privileges or cause the application to crash. | ||||||||
| CVSS v3 Severity: | 9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C) 5.3 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
5.3 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Mon Apr 13 2009 - 10:38:47 CDT [Suspected Spam][Positive Technologies SA 2009-01] PGP Desktop Pgpdisk.sys And Pgpwded.sys Multiple Vulnerabilities Source: MITRE Type: CNA CVE-2009-0681 Source: CCN Type: SA33310 PGP Desktop PGPwded.sys Driver Denial of Service Source: CCN Type: SECTRACK ID: 1022034 PGP Desktop IOCTL Validation Flaws in Pgpdisk.sys and Pgpwded.sys Let Local Users Gain Elevated Privileges Source: CCN Type: BID-34490 PGP Desktop 'pgpdisk.sys' Local Denial of Service Vulnerability Source: XF Type: UNKNOWN pgpdesktop-pgpwded-code-execution(49868) Source: CCN Type: PGP Web site PGP Desktop 9.10 - Resolved Issues | ||||||||
| BACK | |||||||||