CVE-2000-0678: Medium severity PGP PGP vulnerability
Published Oct 13, 2000
·Updated
PGP 5.5.x through 6.5.3 does not properly check if an Additional Decryption Key (ADK) is stored in the signed portion of a public certificate, which allows an attacker who can modify a victim's public certificate to decrypt any data that has been encrypted with the modified certificate.
Affected Software
3 affected components
PGP PGP=6.5.1i
PGP PGP=5.5.3i
PGP PGP=6.5.3i
Remediation
Patch Available
Event History
Oct 13, 2000
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2000-0678?
The severity of CVE-2000-0678 is considered high due to the potential for data decryption without authorization.
2
How do I fix CVE-2000-0678?
To fix CVE-2000-0678, update to a version of PGP that does not contain this vulnerability.
3
What impact does CVE-2000-0678 have on PGP users?
CVE-2000-0678 allows an attacker to decrypt sensitive data by manipulating a victim's public certificate.
4
Which versions of PGP are affected by CVE-2000-0678?
CVE-2000-0678 affects PGP versions 5.5.x through 6.5.3.
5
Who can exploit CVE-2000-0678?
An attacker with the ability to modify a user's public certificate can exploit CVE-2000-0678.