Symantec plays down PGP hole

Symantec has quenched fears about a vulnerability in its PGP technology.

According to a Pastebin statement, the pgpwded.sys kernel driver distributed with Symantec PGP Desktop contains an arbitrary memory overwrite vulnerability in the handling of IOCTL 0x80022058.

While the statement admitted that an attacker would need local access to a vulnerable computer to exploit this vulnerability, successful exploitation of this issue would allow an attacker to execute arbitrary code. The statement also said that this vulnerability (METHO_BUFFERED with output_size == 0) exploit works only on Windows XP/2003.