CVE-2001-1016: High severity PGP Corporate Desktop vulnerability
PGP Corporate Desktop before 7.1, Personal Security before 7.0.3, Freeware before 7.0.3, and E-Business Server before 7.1 does not properly display when invalid userID's are used to sign a message, which could allow an attacker to make the user believe that the document has been signed by a trusted third party by adding a second, invalid user ID to a key which has already been signed by the third party, aka the "PGPsdk Key Validity Vulnerability."
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2001-1016?
CVE-2001-1016 has been classified as a medium severity vulnerability due to the risk of misleading users regarding document authenticity.
How do I fix CVE-2001-1016?
To mitigate CVE-2001-1016, upgrade to PGP Corporate Desktop version 7.1 or higher, Personal Security version 7.0.3 or higher, or Freeware version 7.0.3 or higher.
What software is affected by CVE-2001-1016?
CVE-2001-1016 affects PGP Corporate Desktop versions prior to 7.1, Personal Security prior to 7.0.3, Freeware prior to 7.0.3, and E-Business Server prior to 7.1.
What type of attack can exploit CVE-2001-1016?
CVE-2001-1016 can be exploited by attackers who create documents with invalid userIDs, potentially misleading users into believing they are signed by a trusted source.
Is CVE-2001-1016 related to user authentication?
Yes, CVE-2001-1016 is related to user authentication issues, as it involves the improper validation of userIDs when signing messages.