'Pretty Good' Isn't Good Enough

Network security firm Foundstone said Thursday that it had discovered a significant security vulnerability in PGP, the de facto commercial encryption software.

The flaw stems from an overflow that allows the attacker to take control of the recipient's computer, elevating his or her privileges on the organization's network

According to the firm, the vulnerability could have very wide spread effects due to the trusting nature of encrypted attachments in e-mail, its relative ease of exploitation and the large amount of corporations, military and government agencies that rely on PGP encryption for secure communication.

The flaw, which Foundstone believes could be easily exploited, affects PGP Corporate Edition 7.1.0 and 7.1.1. Software maker.

The attack works by encrypting a file with a public key and sending it to a recipient. Given the trusting nature of public key encryption, the recipient would look at the encrypted file and attempt to decrypt it. However, the act of decrypting the file may also allow arbitrary code to be run on the host.

The attack is effective because PGP does not properly check the length of the filename. An attacker could create an encrypted document and send it to a recipient who trusts the source of the message. As the recipient decrypts the message, the file length will cause a PGP overflow and the software to crash, allowing the attacker to take control of the computer and possibly gain access to sensitive or confidential information on the network.

PGP has issued a fix for this vulnerability, available here.

PGP, which stands for "pretty good privacy," was developed as a freeware program by Phil Zimmerman in the early 90s to provide secure e-mail and file storage using a public key system, and in the past decade, has become the standard for e-mail encryption.

This is not the first time PGP has come under scrutiny for security threats. Initially, in the early 90's when the software came out, the U.S. military believed PGP's security threat was to the nation itself. On Feb. 17, 1993, the government threatened to prosecute its creator for "illegal trafficking in munitions," as U.S. export regulations classify all encryption devices as "munitions," military weapons.

Now, the focus has come on vulnerabilities as the software, bought in 1997 by Network Associates , and recently sold to start-up firm PGA Corp., has had numerous flaws recently.

Last month a flaw was discovered that could allow an attacker to view sensitive information contained in emails, and in July, a flaw was discovered in a PGP plug-in for Outlook which also allows an attacker to take over a users computer.