PT-2002-2237 · Kde · Kgpg

Published 2002-11-29 · Updated 2017-10-10 · CVE-2002-1284

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: KGPG versions 0.6 through 0.8.2

Description: The issue arises from the wizard in KGPG not properly providing the passphrase to gpg when creating new keys. This results in secret keys being created with an empty passphrase, allowing local attackers to steal the keys if they can be read.

Recommendations: For KGPG versions 0.6 through 0.8.2, consider updating to a version where this issue is fixed, as the current versions do not properly secure newly created keys.

Fix

Related Identifiers

CVE-2002-1284

Affected Products

Kgpg

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-1284 · Security Note
• http://devel-home.kde.org/~kgpg/bug.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=103702926611286&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10629 · Note
• http://securityfocus.com/bid/6152 · Note