High severity · published Dec 31, 2002
CVE-2002-2069
PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was…
7.5
CVSS
2.1%
EPSS
No
On KEV
Description
PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
Personal Privacy · Pgp
6.0.2 through 6.5.8; 7.0 through 7.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-2069
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-2069
Broken Link
http://www.ciac.org/ciac/bulletins/m-034.shtml
Broken Link
http://www.iss.net/security_center/static/7953.php
Broken Link
http://www.securityfocus.com/archive/1/251565
Broken Link
http://www.securityfocus.com/bid/3912
Broken Link
http://www.seifried.org/security/advisories/kssa-003.html
More from Personal Privacy
5.5
CVE-2002-1696
Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when opening messages"…
–
CVE-2000-0802
The BAIR program does not properly restrict access to the Internet Explorer Internet options menu, which allows local users to obtain access to the menu by modifying the registry…