PT-2000-1611 · Pgp · Pgp

Publicado 2000-10-20 · Atualizado 2008-09-10 · CVE-2000-0678

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PGP versions 5.5.x through 6.5.3

Description The issue arises from improper checking of an Additional Decryption Key (ADK) in the signed portion of a public certificate. This allows an attacker who can modify a victim's public certificate to decrypt any data that has been encrypted with the modified certificate.

Recommendations For versions 5.5.x through 6.5.3, consider restricting access to certificate modification to prevent exploitation until a proper fix is applied. As a temporary workaround, carefully monitor and control any changes made to public certificates to minimize the risk of decryption by unauthorized parties.

Correção

Identificadores relacionados

CVE-2000-0678

Produtos afetados

Pgp

Referências · 4

• http://securityfocus.com/bid/1606 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2000-0678 · Nota de Segurança
• http://osvdb.org/4354 · Nota
• http://cert.org/advisories/CA-2000-18.html · Nota