Unscored severity · published Sep 4, 2001
CVE-2001-1016
PGP Corporate Desktop before 7.1, Personal Security before 7.0.3, Freeware before 7.0.3, and E-Business Server before 7.1 does not properly display when invalid userID's are used…
–
CVSS
1.4%
EPSS
No
On KEV
Description
PGP Corporate Desktop before 7.1, Personal Security before 7.0.3, Freeware before 7.0.3, and E-Business Server before 7.1 does not properly display when invalid userID's are used to sign a message, which could allow an attacker to make the user believe that the document has been signed by a trusted third party by adding a second, invalid user ID to a key which has already been signed by the third party, aka the "PGPsdk Key Validity Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CD
Corporate Desktop · Pgp
7.1 · source: NVD
ES
E-business Server · Pgp
6.5.8; 7.0.4; 7.1 · source: NVD
FR
Freeware · Pgp
7.0.3 · source: NVD
PS
Personal Security · Pgp
7.0.3 · source: NVD
PG
Pgp · Pgp
5.0; 6.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-1016
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-1016
www.osvdb.org
http://www.osvdb.org/1946
Patch
http://www.pgp.com/support/product-advisories/pgpsdk.asp
Patch
http://www.securityfocus.com/archive/1/211806
Patch
http://www.securityfocus.com/bid/3280
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/7081
More from Corporate Desktop
5.5
CVE-2002-0788
An interaction between PGP 7.0.3 with the "wipe deleted files" option, when used on Windows Encrypted File System (EFS), creates a cleartext temporary files that cannot be wiped…
–
CVE-2007-0603
PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe,…
–
CVE-2002-0850
Buffer overflow in PGP Corporate Desktop 7.1.1 allows remote attackers to execute arbitrary code via an encrypted document that has a long filename when it is decrypted