-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2007.0004                  AUSCERT Advisory

                                   [Win]
         Vulnerability in PGP Desktop may allow system compromise
                              30 January 2007
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              PGP Desktop prior to 9.5.1
Operating System:     Windows XP
                      Windows 2000
Impact:               Administrator Compromise
Access:               Existing Account
Member content until: Tuesday, February 27 2007

OVERVIEW

        A vulnerability in PGP Desktop has been discovered [1] that could
        allow any local or remote authenticated user to execute arbitrary
        code in the context of Local System. Anonymous logins can also
        exploit this vulnerability if they are enabled.


IMPACT

        If this vulnerability is successfully exploited, the attacker
        would have complete control over the target system, allowing them
        to add or remove programs, enable backdoors, install keyloggers
        and other potentially damaging actions.


MITIGATION

        PGP has released PGP Desktop 9.5.1 which addresses this
        vulnerability. Users of PGP Desktop are advised to upgrade to this
        version.


REFERENCES

        [1] NGSSoftware Advisory
            http://www.ngssoftware.com/advisories/medium-risk-vulnerability-in-pgp-desktop/

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRb6e6Ch9+71yA2DNAQI5dwQAg6srEBm9B1gsExlX/bhM0QTfxp5giODp
Z6e1fgdkX5NYtizYxq6ENcngYBR25IY4EnuSSJ4HR5Y1HYv6LrmwNQ1ply8tqcau
zIs8NU+Bh+fHch470z1R5XHJ22wDsLbIrgKLeDZlofpqdMLGCfP8DNdaT+UbClFs
saUpKNQu2IY=
=VK97
-----END PGP SIGNATURE-----