Pierluigi Paganini January 06, 2013

IT community become familiar with the concept of zero-day vulnerability, no matter if it is related to SCADA system or mobile phone firmware, it could allow a hacker to silently interfere with user’s life, exposing it to serious risks.

This time the product affected by the vulnerability is produced by Symantec, it is PGP Whole Disk Encryption and it “provides organizations with comprehensive, high performance full disk encryption for all data (user files, swap files, system files, hidden files, etc.) on desktops, laptops, and removable media.”

The Symantec page for the product reports:

“This full disk encryption software protects data from unauthorized access, providing strong security for intellectual property, customer and partner data. Protected systems can be centrally managed by PGP Universal Server simplifying deployment, policy creation and distribution and reporting.”

On December 25th @NTarakanov tweeted the news of the vulnerability in pgpwded.sys kernel driver distributed with Symantec PGP Desktop reporting a pastebin note that announced that the affected application is Symantec PGP Desktop 10.2.0 Build 2599 (up-to date) meanwhile the affected file is pgpwded.sys version 10.2.0.2599.

 The post states:

“The pgpwded.sys kernel driver distributed with Symantec PGP Desktop contains an arbitrary memory overwrite vulnerability in the handling of IOCTL 0x80022058.  Exploitation of this issue allows an attacker to execute arbitrary code within the kernel. An attacker would need local access to a vulnerable computer to exploit this vulnerability.”

The vulnerability affects only Windows XP/2k3, exploiting of METHO_BUFFERED with output_size == 0 not works for later Windows OSs.

Effective the response of Symantec company that has analyzed immediately the problem also thanks the detailed provided in the post, the expert Kelvin Kwan in an official note confirmed the vulnerability sustaining that it very complicated to exploit because an attacker need to gain physical access to the system to compromise it.

“Essentially, this vulnerability is limited to systems running Windows XP and Windows 2003 only.  The attacker would need to be logged into the system to trigger the exploit.  However, the exploit would be very difficult to trigger as it relies on the system entering an error condition first.  Once in this error condition, the exploit could allow an attacker with lower privileges to run some arbitrary code with higher privileges.  Later versions of Windows do not have this vulnerability.” 

My opinion is that every software could be affected by a vulnerability, fundamental is the patch management once is it discovered, it is crucial to reduce the windows of exposure to avoid serious consequences, for this reason Symantec has declared to fix the dangerous bug with a maintenance pack that will be released early in February.

Pierluigi Paganini