[wsir-01/02-03] PGP 7.0 Split Key/Cached Passphrase Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TITLE: PGP 7.0 Split Key/Cached Passphrase Vulnerability ADVISORY ID: WSIR-01/02-03 DISCOVERED BY: Patrik Birgersson, Wkit Security AB CONTACT: [email protected] CLASS: --- OBJECT: PGP Desktop Security 7.0 VENDOR: Network Associates Technology Inc...

Проблемы в PGP Desktop Security

Пользователь получивший право подписи одного документа с помощью разделенного ключа может подписать этим же ключем любой другой документ при включеном кэшировании ключевой фразы без согласия остальных держателей ключа...

PGP 5.x/6.x/7.0 - ASCII Armor Parser Arbitrary File Creation

source: https://www.securityfocus.com/bid/2556/info ASCII Armor is a text based encoding format used by PGP Pretty Good Privacy. While it is possible to encode any file using ASCII Armor, it is used by PGP to encode signature files and public keys to facilitate transmission in e-mail messages. Wh...

PGP 5.x6.x7.0 - ASCII Armor Parser Arbitrary File Creation

PGP 5.x6.x7.0 - ASCII Armor Parser Arbitrary File Creation source: https://www.securityfocus.com/bid/2556/info ASCII Armor is a text based encoding format used by PGP Pretty Good Privacy. While it is possible to encode any file using ASCII Armor, it is used by PGP to encode signature files and...

CVE-2001-0273

CVE-2001-0273 affects pgp4pine 1.75-6. The module fails to verify whether public keys loaded from GnuPG are expired, which can lead to encrypt attempts returning errors while the cleartext message is transmitted. According to CERT/CC and NVD entries, the vulnerability can cause sensitive informat...

CVE-2001-0273

pgp4pine Pine/PGP interface version 1.75-6 does not properly check to see if a public key has expired when obtaining the keys via Gnu Privacy Guard GnuPG, which causes the message to be sent in cleartext...

Проблема с PGP

При разборе подписаных ключей не сверяется соответствие ключа сигнатуре...

Advisory: PGP 7.0 signature verification vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Product: Pretty Good Privacy Severity: Medium to high Impact: Users with write access to signed exported key blocks may replace them with arbitrary keys without any warning being issued upon import of those keys Local: Yes Remote: No though...

CVE-2000-0678

PGP 5.5.x through 6.5.3 does not properly check if an Additional Decryption Key ADK is stored in the signed portion of a public certificate, which allows an attacker who can modify a victim's public certificate to decrypt any data that has been encrypted with the modified certificate...

CVE-2000-0445

The pgpk command in PGP 5.x on Unix systems uses an insufficiently random data source for non-interactive key pair generation, which may produce predictable keys...

CVE-2000-0445

The CVE-2000-0445 issue affects PGP 5.x on Unix-like systems where non-interactive (batch) key generation via pgpk can use insufficient randomness collected from /dev/random. The root cause is how PGP v5.0 processes entropy when generating keys in unattended mode, potentially producing weak, pred...

CVE-2000-0678

CVE-2000-0678 affects PGP 5.5.x through 6.5.3. The flaw: ADKs are not checked in the signed portion of a public certificate, so an attacker who modifies a victim’s certificate can decrypt data encrypted with that modified certificate. Exploitation requires a modified certificate and a sender usin...

CVE-2000-0678

PGP 5.5.x through 6.5.3 does not properly check if an Additional Decryption Key ADK is stored in the signed portion of a public certificate, which allows an attacker who can modify a victim's public certificate to decrypt any data that has been encrypted with the modified certificate...

CVE-2000-0678: Undefined Security Weakness

PGP 5.5.x through 6.5.3 does not properly check if an Additional Decryption Key ADK is stored in the signed portion of a public certificate, which allows an attacker who can modify a victim's public certificate to decrypt any data that has been encrypted with the modified certificate...

CVE-2000-0445: Undefined Security Weakness

The pgpk command in PGP 5.x on Unix systems uses an insufficiently random data source for non-interactive key pair generation, which may produce predictable keys...

ADK flaw in recent versions of PGP

Overview Additional Decryption Keys ADKs is a feature introduced into PGP Pretty Good Privacy versions 5.5.x through 6.5.3 that allows authorized extra decryption keys to be added to a user's public key certificate. However, an implementation flaw in PGP allows unsigned ADKs which have been...

Большая проблема в PGP (ADK)

PGP позволяет использовать ADK Additional Decription Keys для работы агентов восстановления. ADK добавляется к открытому ключу, при передаче ключа проиходит дополнительное шифрование с помощью ADK. Проблема в том, что при разборе PGP-сертификата PGP не проверяет правильно ли подсчитан хэш ADK, чт...

Advisory CA-2000-18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CERT Advisory CA-2000-18 PGP May Encrypt Data With Unauthorized ADKs Original release date: August 24, 2000 Last revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected PGP versions 5.5.x through 6.5.3,...

[Security] Mailman exploitability

Attachment: pgph2MPti2iCN.pgp Description: PGP message...

CVE-2000-0543

The command port for PGP Certificate Server 2.5.0 and 2.5.1 allows remote attackers to cause a denial of service if their hostname does not have a reverse DNS entry and they connect to port 4000...