PT-2000-1611 · Pgp · Pgp

Published 2000-10-20 · Updated 2008-09-10 · CVE-2000-0678

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PGP versions 5.5.x through 6.5.3

Description The issue arises from improper checking of an Additional Decryption Key (ADK) in the signed portion of a public certificate. This allows an attacker who can modify a victim's public certificate to decrypt any data that has been encrypted with the modified certificate.

Recommendations For versions 5.5.x through 6.5.3, consider restricting access to certificate modification to prevent exploitation until a proper fix is applied. As a temporary workaround, carefully monitor and control any changes made to public certificates to minimize the risk of decryption by unauthorized parties.

Fix

Related Identifiers

CVE-2000-0678

Affected Products

Pgp

References · 4

• http://securityfocus.com/bid/1606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-0678 · Security Note
• http://osvdb.org/4354 · Note
• http://cert.org/advisories/CA-2000-18.html · Note