PT-2000-1884 · Gnu · Gnupg

Published 2000-12-19 · Updated 2018-05-03 · CVE-2000-0974

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GnuPG (gpg) version 1.0.3

Description The issue concerns a problem with signature verification in files containing multiple documents. Specifically, it does not properly check all signatures, which allows an attacker to modify the contents of all documents except the first one without being detected.

Recommendations For GnuPG (gpg) version 1.0.3, update to a newer version that properly checks all signatures of a file containing multiple documents to prevent undetected modifications.

Exploit

Fix

Related Identifiers

CVE-2000-0974

Affected Products

Gnupg

References · 11

• 🔥 http://securityfocus.com/bid/1797 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0974 · Security Note
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:67.gnupg.asc · Note
• http://osvdb.org/1608 · Note
• http://archives.neohapsis.com/archives/bugtraq/2000-10/0201.html · Note
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2000-038.0.txt · Note
• http://debian.org/security/2000/20001111 · Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000334 · Note
• http://redhat.com/support/errata/RHSA-2000-089.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2000-10/0361.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5386 · Note