CVE-2009-3805 Denial of service in n/a
Remote attackers can crash Gpg4win's gpg2.exe by sending a long certificate signature, affecting users of KDE Kleopatra.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2009-3805?
CVE-2009-3805 is a medium-severity denial of service vulnerability in n/a, published on 27 Oct 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
gpg2.exe in Gpg4win 2.0.1, as used in KDE Kleopatra 2.0.11, allows remote attackers to cause a denial of service (application crash) via a long certificate signature.
Which versions are affected by CVE-2009-3805?
It affects 1 product.
Products include Gpg4win Gpg4win.
How do I fix CVE-2009-3805?
No fix has been published for CVE-2009-3805 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2009-3805 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-3805 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-hj6j-7rxv-mfh3.