Lucene search

[email protected]CVE-2002-1284

HistorySep 01, 2004 - 4:00 a.m.

CVE-2002-1284

2004-09-0104:00:00

[email protected]

web.nvd.nist.gov

kgpg

vulnerability

key theft

passphrase

local attack

cve-2002-1284

nvd

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

The wizard in KGPG 0.6 through 0.8.2 does not properly provide the passphrase to gpg when creating new keys, which causes secret keys to be created with an empty passphrase and allows local attackers to steal the keys if they can be read.

Affected configurations

NVD

Node

kgpgkgpgMatch0.6

kgpgkgpgMatch0.6.1

kgpgkgpgMatch0.7

kgpgkgpgMatch0.8

kgpgkgpgMatch0.8.1

kgpgkgpgMatch0.8.2

CPENameOperatorVersion
kgpg:kgpgkgpgeq0.6
kgpg:kgpgkgpgeq0.6.1
kgpg:kgpgkgpgeq0.7
kgpg:kgpgkgpgeq0.8
kgpg:kgpgkgpgeq0.8.1
kgpg:kgpgkgpgeq0.8.2

CPE	Name	Operator	Version
kgpg:kgpg	kgpg	eq	0.6
kgpg:kgpg	kgpg	eq	0.6.1
kgpg:kgpg	kgpg	eq	0.7
kgpg:kgpg	kgpg	eq	0.8
kgpg:kgpg	kgpg	eq	0.8.1
kgpg:kgpg	kgpg	eq	0.8.2

References

devel-home.kde.org/~kgpg/bug.html

marc.info/?l=bugtraq&m=103702926611286&w=2

www.securityfocus.com/bid/6152

exchange.xforce.ibmcloud.com/vulnerabilities/10629

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2002-1284

cvelist1 nvd1