WinPT User ID Spoofing Vulnerability
WinPT User ID Spoofing Vulnerability
Impact: Impersonation
Where: Remote
Status: Unpatched
Product: Windows Privacy Tray (WinPT)
http://wald.intevation.org/projects/winpt
Visual representation of keys in WinPT 1.2.0 is susceptible to a user ID
spoofing attack using keys with large amount of data in the user IDs. In
several instances the key user IDs are displayed in a fixed size window and any
excessive user ID data are simply visually truncated. This allows an attacker
to trick a target into using a key with additional user IDs that are hidden
during certain operations, including key importing, key signing, key editing,
and signature listing. This can in turn lead to unintentional encryption of
sensitive information with the attacker's key instead of the legitimate key.
Attack Scenario:
The attacker creates a key with one or more user IDs that the target is willing
to import and sign, e.g. "Attacker <attacker@xxxxxxx>". If the objective is to
obtain data normally encrypted for victim@xxxxxxx then the attacker adds a user
ID that looks like:
Attacker <attacker@xxxxxxx>"SSSSMMMMSSSS<victim@xxxxxxx>
where SSSS represents a large number of spaces (0x20) and MMMM is a bogus WinPT
message. This will cause <victim@xxxxxxx> to stay hidden and the message will
further strengthen user's perception that he sees all key data.
Encrypting a sensitive plaintext for victim@xxxxxxx with GnuPG will use the
attacker's key as long as it has been loaded into the keyring before the
legitimate key:
C:\>echo This is a secret | gpg -r victim@xxxxxxx -e | gpg
gpg: encrypted with 1024-bit ELG-E key, ID 7F378BF7, created 2007-03-09
"Attacker <attacker@xxxxxxx>"
A more detailed description including a sample key and screen shots is
available in the WinPT bug repository (bug 327).
The vulnerability has been identified in version 1.2.0. However, other versions
may be also affected.
Workaround:
Do not rely on WinPT to inspect and/or import keys; use GnuPG instead.
History:
3/9/07: Issue filed as bug 327
3/9/07: Issue acknowledged by the project maintainer
4/4/07: Maintainer announces an indefinite suspension of the project.
5/18/07: Request for a bug status
6/5/07: Request for a bug status
6/11/07: Public disclosure
Found by:
nnposter