CVE-2000-0678

PGP 5.5.x through 6.5.3 does not properly check if an Additional Decryption Key ADK is stored in the signed portion of a public certificate, which allows an attacker who can modify a victim's public certificate to decrypt any data that has been encrypted with the modified certificate...

CVE-2000-0445

The pgpk command in PGP 5.x on Unix systems uses an insufficiently random data source for non-interactive key pair generation, which may produce predictable keys...

ADK flaw in recent versions of PGP

Overview Additional Decryption Keys ADKs is a feature introduced into PGP Pretty Good Privacy versions 5.5.x through 6.5.3 that allows authorized extra decryption keys to be added to a user's public key certificate. However, an implementation flaw in PGP allows unsigned ADKs which have been...

Advisory CA-2000-18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CERT Advisory CA-2000-18 PGP May Encrypt Data With Unauthorized ADKs Original release date: August 24, 2000 Last revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected PGP versions 5.5.x through 6.5.3,...

Большая проблема в PGP (ADK)

PGP позволяет использовать ADK Additional Decription Keys для работы агентов восстановления. ADK добавляется к открытому ключу, при передаче ключа проиходит дополнительное шифрование с помощью ADK. Проблема в том, что при разборе PGP-сертификата PGP не проверяет правильно ли подсчитан хэш ADK, чт...

[Security] Mailman exploitability

Attachment: pgph2MPti2iCN.pgp Description: PGP message...

CVE-2000-0543

CVE-2000-0543 affects NAI PGP Certificate Server versions 2.5.0 and 2.5.1. The vulnerability allows an unauthenticated remote attacker to cause a denial of service by connecting to the service’s command port (TCP 4000) and sending connection attempts that, under conditions where the host name lac...

CVE-2000-0543

The command port for PGP Certificate Server 2.5.0 and 2.5.1 allows remote attackers to cause a denial of service if their hostname does not have a reverse DNS entry and they connect to port 4000...

NAI PGP Certificate Server Unresolvable IP DoS

It was possible to make the remote PGP Cert Server crash by spoofing a TCP connection that seems to come from an unresolvable IP address. An attacker may use this flaw to prevent your PGP certificate server from working properly. This script was written by John Lampe [email protected] See the...

DoS против PGP Certificate Server

При подключении на порт 4000 хоста у которого не разрешается имя DNS сервер произхводит обращение по нулевому указателю...

CVE-2000-0543

The command port for PGP Certificate Server 2.5.0 and 2.5.1 allows remote attackers to cause a denial of service if their hostname does not have a reverse DNS entry and they connect to port 4000...

Linux news 30.05.00

Linux 2.4.0test1-ac4 Alan Cox выпустил четвертую модификацию ядра Linux 2.4.0test1. Подробнее: .kernel.org:/pub/linux/krernel/v2.4.0 Ошибка в PGP5.0 Найдена ошибка в комплекте программ PGP 5.0. Следует отметить, что эта ошибка работает только на утилитах, вызываемых из командной строки и только н...

Проблема генерации ключей в PGP 5.0

При определенных условиях в Unix-версиях используется фиксированная последовательность вместо случайной при генерации ключа...

Key Generation Security Flaw in PGP 5.0

SECURITY FLAW IN PGP 5.0 ======================== EXECUTIVE SUMMARY ----------------- A flaw has been found in the randomness gathering code of PGP 5. PGP 5 will, under certain well-defined circumstances, generate public/private key pairs with no or only a small amount of randomness. Such keys ar...

CVE-2000-0445

The pgpk command in PGP 5.x on Unix systems uses an insufficiently random data source for non-interactive key pair generation, which may produce predictable keys...

Debian GNU/Linux 2.1r3 fixes reported security problems

Attachment: pgpLDjOf8BC9y.pgp Description: PGP message...

Debian GNU/Linux 2.1r3 fixes reported security problems

Attachment: pgpLDjOf8BC9y.pgp Description: PGP message...

afio.pgp.txt

Date: Fri, 11 Jun 1999 16:55:30 -0000 From: [email protected] To: [email protected] Subject: fwd SECURITY: afio: security hole in 'afio -P pgp' encrypted archives Hello, Just found it on comp.os.linux.announce. Sorry if it was already on the list. cezar -----BEGIN PGP SIGNED MESSAGE----- I belie...

[SECURITY] New versions of Mutt fixes buffer overflow

We have received a report from Paul Boehm stating that Mutt has an overflowable buffer in parse.c. When sending malicious mail you can execute arbitary code on the mutt running users system. We recommend you upgrade your Mutt package immediately. dpkg -i file.deb will install the referenced file...

CVE-1999-1270

KMail in KDE 1.0 provides a PGP passphrase as a command line argument to other programs, which could allow local users to obtain the passphrase and compromise the PGP keys of other users by viewing the arguments via programs that list process information, such as ps...