ADVISORY/Foundstone Discovers High-Risk Vulnerability in PGP, the Leading Commercial Encryption Software.

Business Editors & High-Tech Writers

ADVISORY...

--(BUSINESS WIRE)

      Vulnerability Allows Hackers to Take Control of Recipient's
    Computer, Possibly Gaining Access to Sensitive or Confidential
                      Information on the Network

WHAT:  Foundstone, the leading provider of enterprise vulnerability
       management software and services, has discovered significant
       security vulnerability in PGP, the leading commercial
       encryption software. Foundstone classifies this vulnerability
       as "High Risk," due to the trusting nature of encrypted
       attachments in e-mail, its relative ease of exploitation and
       the large amount of corporations, military and government
       agencies that rely on PGP encryption for secure communication.
       This overflow allows the attacker to take control of the
       recipient's computer, elevating his or her privileges on the
       organization's network.

       Previously thought to be an impractical attack because of the
       sophistication of PGP's encryption, Foundstone believes this
       can actually be easily exploited. This vulnerability poses a
       significant risk to thousands of corporate and millions of
       individual users worldwide, including many of the world's
       largest and most security sensitive enterprises, government
       agencies and individuals. PGP is the world's most well-known
       commercial encryption software.

       Foundstone's global R&D security team used proprietary
       methodologies to discover this vulnerability and will
       incorporate this research discovery to develop and refine
       future Foundstone enterprise products and services.

HOW:   The attack works by encrypting a file with a public key and
       sending it to a recipient. Given the trusting nature of public
       key encryption, the recipient would look at the encrypted file
       and attempt to decrypt it. However, the act of decrypting the
       file may allow arbitrary code to be run on the host. The
       attack is effective because PGP does not properly check the
       length of the filename such as "foryoureyesonly.pgp" or
       "veryconfidential.pgp." For example, an attacker can create an
       encrypted document and send it to a recipient who trusts the
       source of the message. As the recipient decrypts the message,
       the file length will cause a PGP overflow and the software to
       crash, allowing the attacker to take control of the computer
       and possibly gain access to sensitive or confidential
       information on the network.

THE
FIX:   PGP has issued a fix for this vulnerability; it is available at:
    www.nai.com/naicommon/download/upgrade/patches/patch-pgphotfix.asp

WHO:   Foundstone Inc. addresses the security and privacy needs
       of Global 2000 companies with world-class Enterprise
       Vulnerability Management Software, Managed Vulnerability
       Assessment Service, Professional Consulting and Education
       offerings. The company has one of the most dominant security
       talent pools ever assembled, including experts from Ernst &
       Young, KPMG, PricewaterhouseCoopers and the U.S. Defense
       Department. Foundstone executives and consultants have
       authored eight books, including the international best-seller
       "Hacking Exposed: Network Security Secrets & Solutions."
       Foundstone has headquarters in Orange County, Calif., and has
       offices in New York, Washington, D.C. and Seattle. For more
       information, visit www.foundstone.com or call 877/91-FOUND.