PGP Invalid Key Display Vulnerability

Bugtraq ID:	3280
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 04 2001 12:00AM
Updated:	Sep 04 2001 12:00AM
Credit:	This vulnerability was reported by Sieuwert van Otterloo.
Vulnerable:	Network Associates PGP Personal Security 7.0.3 - Apple Mac OS 9 9.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME Network Associates PGP Freeware 7.0.3 - Apple Mac OS 9 9.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 98 b - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 Network Associates PGP E-Business Server 7.1 - HP HP-UX 11.11 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - HP HP-UX 10.26 - HP HP-UX 10.20 - HP HP-UX 10.9 - HP HP-UX 10.8 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - IBM AIX 4.2.1 - IBM AIX 4.2 - IBM AIX 5.1 - IBM OS/390 V2R9 - IBM OS/390 V2R6 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Redhat Linux 7.2 - Redhat Linux 7.1 i386 - Redhat Linux 7.0 J i386 - Redhat Linux 7.0 i386 - Redhat Linux 6.2 E i386 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - Redhat Linux 6.0 - Redhat Linux 5.x - Sun Solaris 2.5.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 Network Associates PGP E-Business Server 7.0.4 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - IBM AIX 4.2.1 - IBM AIX 4.2 - IBM AIX 5.1 - IBM OS/390 V2R9 - IBM OS/390 V2R6 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Redhat Linux 7.2 - Redhat Linux 7.1 i386 - Redhat Linux 7.0 J i386 - Redhat Linux 7.0 i386 - Redhat Linux 6.2 E i386 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - Redhat Linux 6.0 - Redhat Linux 5.x - Sun Solaris 2.5.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 Network Associates PGP E-Business Server 6.5.8 - IBM OS/390 V2R9 - IBM OS/390 V2R6 Network Associates PGP Corporate Desktop 7.1 - Apple Mac OS 9 9.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 98 b - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 Network Associates PGP 6.0.2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Network Associates PGP 5.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

PGP Invalid Key Display Vulnerability

There is no exploit necessary to take advantage of this vulnerability.

PGP Invalid Key Display Vulnerability

Solution:
PGP Security has released hotfixes to address this vulnerability.


Network Associates PGP E-Business Server 6.5.8

• Network Associates PGPEBus658_Hotfix0904_OS390.tar.gz
  Hotfix for OS/390 Platform.
  http://download.nai.com/products/licensed/pgp/e-business/MVS/version_6 .5.8/hotfix/PGPEBus658_Hotfix0904_OS390.tar.gz

Network Associates PGP Freeware 7.0.3

• Network Associates PGP_Hotfix0904_Mac.sit.bin
  Hotfix for Mac platform.
  http://download.nai.com/products/licensed/pgp/desktop_security/mac/ver sion_7.1/hotfix/PGP_Hotfix0904_Mac.sit.bin


• Network Associates PGP_Hotfix0904_Win32.zip
  Hotfix for Windows platforms.
  http://download.nai.com/products/licensed/pgp/desktop_security/windows /version_7.1/hotfix/PGP_Hotfix0904_Win32.zip

Network Associates PGP Personal Security 7.0.3

• Network Associates PGP_Hotfix0904_Mac.sit.bin
  Hotfix for Mac platform.
  http://download.nai.com/products/licensed/pgp/desktop_security/mac/ver sion_7.1/hotfix/PGP_Hotfix0904_Mac.sit.bin


• Network Associates PGP_Hotfix0904_Win32.zip
  Hotfix for Windows platforms.
  http://download.nai.com/products/licensed/pgp/desktop_security/windows /version_7.1/hotfix/PGP_Hotfix0904_Win32.zip

Network Associates PGP E-Business Server 7.0.4

• Network Associates PGPEBiz70_Hotfix0904_AIX.tar.gz
  Hotfix for AIX.
  http://download.nai.com/products/licensed/pgp/e-business/unix/version_ 7.0/hotfix/PGPEBiz70_Hotfix0904_AIX.tar.gz


• Network Associates PGPEBiz70_Hotfix0904_HPUX.tar.gz
  Hotfix for HPUX.
  http://download.nai.com/products/licensed/pgp/e-business/unix/version_ 7.0/hotfix/PGPEBiz70_Hotfix0904_HPUX.tar.gz


• Network Associates PGPEBiz70_Hotfix0904_Linux.tar.gz
  Hotfix for Linux.
  http://download.nai.com/products/licensed/pgp/e-business/unix/version_ 7.0/hotfix/PGPEBiz70_Hotfix0904_Linux.tar.gz


• Network Associates PGPEBiz70_Hotfix0904_Solaris.tar.gz
  Hotfix for Solaris.
  http://download.nai.com/products/licensed/pgp/e-business/unix/version_ 7.0/hotfix/PGPEBiz70_Hotfix0904_Solaris.tar.gz

Network Associates PGP E-Business Server 7.1

• Network Associates PGPEBiz71_Hotfix0904_AIX.tar.gz
  Hotfix for AIX.
  http://download.nai.com/products/licensed/pgp/e-business/unix/version_ 7.1/hotfix/PGPEBiz71_Hotfix0904_AIX.tar.gz


• Network Associates PGPEBiz71_Hotfix0904_HPUX.tar.gz
  Hotfix for HPUX.
  http://download.nai.com/products/licensed/pgp/e-business/unix/version_ 7.1/hotfix/PGPEBiz71_Hotfix0904_HPUX.tar.gz


• Network Associates PGPEBiz71_Hotfix0904_Linux.tar.gz
  Hotfix for Linux.
  http://download.nai.com/products/licensed/pgp/e-business/unix/version_ 7.1/hotfix/PGPEBiz71_Hotfix0904_Linux.tar.gz


• Network Associates PGPEBiz71_Hotfix0904_Solaris.tar.gz
  Hotfix for Solaris.
  http://download.nai.com/products/licensed/pgp/e-business/unix/version_ 7.1/hotfix/PGPEBiz71_Hotfix0904_Solaris.tar.gz

Network Associates PGP Corporate Desktop 7.1

• Network Associates PGP_Hotfix0904_Mac.sit.bin
  Hotfix for Mac platform.
  http://download.nai.com/products/licensed/pgp/desktop_security/mac/ver sion_7.1/hotfix/PGP_Hotfix0904_Mac.sit.bin


• Network Associates PGP_Hotfix0904_Win32.zip
  Hotfix for Windows platforms.
  http://download.nai.com/products/licensed/pgp/desktop_security/windows /version_7.1/hotfix/PGP_Hotfix0904_Win32.zip

PGP Invalid Key Display Vulnerability

References:

• A security Analysis of PGP (Blue Ring Software)
  
• PGPsdk Key Validity Vulnerability (PGP Security)