NAI Follows Through
Despite company transition turmoils, NAI patches up a buffer overflow.
October 7, 2002
![Network Computing logo Network Computing logo](https://eu-images.contentstack.com/v3/assets/bltde8121fc52c5c8f3/blt3f3d0318f746b1c2/65a530e4187606040a1d8b8c/placeholder.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
A buffer overflow has been discovered by Foundstone in all versions of Pretty Good Privacy Corporate Desktop 7.1. And Network Associates has issued a hot fix.
The overflow occurs when PGP Corporate Desktop tries to decrypt a PGP archive that contains a file name with more than 200 characters. Foundstone was able to run arbitrary code by sending a PGP-encrypted archive containing a long file name using a proof-of-concept exploit the vendor developed.
It's commendable that even though Network Associates is in the process of divesting itself of interests in PGP, it researched the problem and issued a patch. NAI could have passed the problem off to PGP Corp. In the turmoil of a company transition, the vulnerability may not have received the attention it deserved.
That's not to say that NAI jumped on the problem without prodding. Foundstone did have to get to the right person at NAI. But this event serves as a good example of responsible disclosure. All vendors should be so responsive
--Mike Fratto
Read more about:
2002You May Also Like
Maximizing cloud potential: Building and operating an effective Cloud Center of Excellence (CCoE)
September 10, 2024Radical Automation of ITSM
September 19, 2024Unleash the power of the browser to secure any device in minutes
September 24, 2024