PT-2002-2237 · Kde · Kgpg

Publicado 2002-11-29 · Atualizado 2017-10-10 · CVE-2002-1284

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: KGPG versions 0.6 through 0.8.2

Description: The issue arises from the wizard in KGPG not properly providing the passphrase to gpg when creating new keys. This results in secret keys being created with an empty passphrase, allowing local attackers to steal the keys if they can be read.

Recommendations: For KGPG versions 0.6 through 0.8.2, consider updating to a version where this issue is fixed, as the current versions do not properly secure newly created keys.

Correção

Identificadores relacionados

CVE-2002-1284

Produtos afetados

Kgpg

Referências · 5

• http://marc.info/?l=bugtraq&m=103702926611286&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1284 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10629 · Nota
• http://devel-home.kde.org/~kgpg/bug.html · Aviso do Fabricante
• http://securityfocus.com/bid/6152 · Nota