WinPT User ID Spoofing Vulnerability

Advisory Content :

WinPT User ID Spoofing Vulnerability

Impact: Impersonation
Where: Remote
Status: Unpatched

Product: Windows Privacy Tray (WinPT)
http://wald.intevation.org/projects/winpt

Visual representation of keys in WinPT 1.2.0 is susceptible to a user ID
spoofing attack using keys with large amount of data in the user IDs. In
several instances the key user IDs are displayed in a fixed size window and
any excessive user ID data are simply visually truncated. This allows an
attacker to trick a target into using a key with additional user IDs that
are hidden during certain operations, including key importing, key signing,
key editing, and signature listing. This can in turn lead to unintentional
encryption of sensitive information with the attacker's key instead of the
legitimate key.

Attack Scenario:

The attacker creates a key with one or more user IDs that the target is
willing to import and sign, e.g. "Attacker <attacker (at) foo (dot) org
[email concealed]>". If the objective is to obtain data normally encrypted
for victim (at) bar (dot) com [email concealed] then the attacker adds a
user ID that looks like:

Attacker <attacker (at) foo (dot) org [email
concealed]>"SSSSMMMMSSSS<victim (at) bar (dot) com [email concealed]>

where SSSS represents a large number of spaces (0x20) and MMMM is a bogus
WinPT message. This will cause <victim (at) bar (dot) com [email
concealed]> to stay hidden and the message will further strengthen user's
perception that he sees all key data.

Encrypting a sensitive plaintext for victim (at) bar (dot) com [email
concealed] with GnuPG will use the attacker's key as long as it has been
loaded into the keyring before the legitimate key:

C:>echo This is a secret | gpg -r victim (at) bar (dot) com [email
concealed] -e | gpg
gpg: encrypted with 1024-bit ELG-E key, ID 7F378BF7, created
2007-03-09
"Attacker <attacker (at) foo (dot) com [email concealed]>"

A more detailed description including a sample key and screen shots is
available in the WinPT bug repository (bug 327).

The vulnerability has been identified in version 1.2.0. However, other
versions may be also affected.

Workaround:

Do not rely on WinPT to inspect and/or import keys; use GnuPG instead.

History:
3/9/07: Issue filed as bug 327
3/9/07: Issue acknowledged by the project maintainer
4/4/07: Maintainer announces an indefinite suspension of the project.
5/18/07: Request for a bug status
6/5/07: Request for a bug status
6/11/07: Public disclosure

Found by:
nnposter

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

WinPT User ID Spoofing Vulnerability