Vulnerability in Pgp Corporate Desktop
CVE-2001-1016
PGP Corporate Desktop before 7.1, Personal Security before 7.0.3, Freeware before 7.0.3, and E-Business Server before 7.1 does not properly display when invalid userID's are used to sign a message, which could allow an attacker to make the user believe that the document has been signed by a trusted third party by adding a second, invalid user ID to a key which has already been signed by the third party, aka the "PGPsdk Key Validity Vulnerability."
EPSS: 0.014 (68.9th percentile) — read the EPSS interpretation.
Affected products
- Pgp Corporate_desktop — versions 7.1
- Pgp E-business_server — versions 6.5.8, 7.0.4, 7.1
- Pgp Freeware — versions 7.0.3
- Pgp Personal_security — versions 7.0.3
- Pgp — versions 5.0, 6.0.2
- N/a — versions n/a
References
- cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_BUGTRAQ, Patch)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)