SSH1 may generate weak passphrase when using Secure RPC

Overview The secure-RPC feature of the SSH1 client in Solaris sometimes encrypts the SSH private key file with a weak passphrase, which can be determined by an attacker and used to recover the SSH private keys. Other versions of the SSH client running on non-Solaris platforms are not affected by...

CVE-2001-0435

The CVE-2001-0435 entry concerns the split key mechanism in PGP 7.0 . The root issue is that a key share holder can obtain access to the entire key by enabling the “Cache passphrase while logged on” option and then capturing the passphrases of other share holders as they authenticate. Documents s...

CVE-2001-0435: Undefined Security Weakness

The split key mechanism used by PGP 7.0 allows a key share holder to obtain access to the entire key by setting the "Cache passphrase while logged on" option and capturing the passphrases of other share holders as they authenticate...

[wsir-01/02-03] PGP 7.0 Split Key/Cached Passphrase Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TITLE: PGP 7.0 Split Key/Cached Passphrase Vulnerability ADVISORY ID: WSIR-01/02-03 DISCOVERED BY: Patrik Birgersson, Wkit Security AB CONTACT: [email protected] CLASS: --- OBJECT: PGP Desktop Security 7.0 VENDOR: Network Associates Technology Inc...

Проблемы в PGP Desktop Security

Пользователь получивший право подписи одного документа с помощью разделенного ключа может подписать этим же ключем любой другой документ при включеном кэшировании ключевой фразы без согласия остальных держателей ключа...

Watchguard Firewall Elevated Privilege Vulnerability

I have found that the embedded Linux-based Watchguard Firebox II Firewall product range is vulnerable to read-write access using only a read-only passphrase. This gives a read-only user the ability to make changes to the firewall remotely without either authorization or a read-write passphrase. T...

Bug in SSH1 secure-RPC support can expose users' private keys

Hello all, There is a bug in SSH-1.2.30 involving Secure RPC. The patch for this is available at http://www.ssh.com/patches.html. The explanation and bug was submitted by Richard Silverman [email protected], and his explanation of the bug is below. The SSH1 protocol is not formally supported by SSH...

CVE-1999-1270

KMail in KDE 1.0 provides a PGP passphrase as a command line argument to other programs, which could allow local users to obtain the passphrase and compromise the PGP keys of other users by viewing the arguments via programs that list process information, such as ps...