[SNS Advisory No.43] PGP Keyserver Permissions Misconfiguration

["snsadv () lac co jp" <snsadv () lac co jp>]

----------------------------------------------------------------------
SNS Advisory No.43
PGP Keyserver Permissions Misconfiguration

Problem first discovered: Fri, 3 Aug 2001
Published: Fri, 28 Sep 2001
----------------------------------------------------------------------

Overview:
---------
 PGP Keyserver, distributed by Network Associates, contains a vulnerability
 that allows attackers to access administrative web interface without 
 authentication.

Problem Description:
--------------------
 PGP Keyserver, distributed by Network Associates, is configured using
 administrative web interface. It is necessary to authenticate username
 and password in order to access the administrative web interface.

 However, PGP Keyserver has a vulnerability that allows unauthorized users
 to change settings. Normally, changes of configuration via authentication
 occur in the following URL:

　　　　http://server.name/keyserver/cgi-bin/console.exe?page_size=...
　　　　http://server.name/keyserver/cgi-bin/cs.exe?action=...

 PGP Keyserver allows attackers to perform administrative tasks without
 authentication by using the following URL:

　　　　http://server.name/cgi-bin/console.exe?page_size=...
　　　　http://server.name/cgi-bin/cs.exe?action=...


Tested Version: 
---------------
 PGP Keyserver 7.0 for Windows NT

Tested on:
----------
 Windows 2000 Server + SP2 [English]

Solution:
---------
 A solution for this security issue in PGP Keyserver 7.0 is available at:
 http://www.pgp.com/support/product-advisories/keyserver.asp

Discovered by:
--------------
 Nobuo Miwa (LAC / snsadv () lac co jp)


Disclaimer:
-----------
 All information in these advisories are subject to change without any 
 advanced notices neither mutual consensus, and each of them is released
 as it is. LAC Co.,Ltd. is not responsible for any risks of occurrences
 caused by applying those information. 

References
----------
 Archive of this advisory(in preparation now):
 http://www.lac.co.jp/security/english/snsadv_e/43_e.html

------------------------------------------------------------------
Secure Net Service(SNS) Security Advisory <snsadv () lac co jp>
Computer Security Laboratory, LAC  http://www.lac.co.jp/security/