CVE-2001-1016 Security feature bypass in n/a
Attackers can spoof digital signatures by adding invalid user IDs, tricking users into trusting unverified documents in PGP applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2001-1016?
CVE-2001-1016 is a high-severity vulnerability in n/a, published on 9 Mar 2002. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PGP Corporate Desktop before 7.1, Personal Security before 7.0.3, Freeware before 7.0.3, and E-Business Server before 7.1 does not properly display when invalid userID's are used to sign a message, which could allow an attacker to make the user believe that the document has been signed by a trusted third party by adding a second, invalid user ID to a key which has already been signed by the third party, aka the "PGPsdk Key Validity Vulnerability."
Which versions are affected by CVE-2001-1016?
It affects 5 products.
Products include Pgp Corporate Desktop, Pgp E-Business Server, Pgp Freeware, Pgp Personal Security, Pgp Pgp.
How do I fix CVE-2001-1016?
No fix has been published for CVE-2001-1016 yet. Limit exposure of the affected software until one is available.
Is CVE-2001-1016 being exploited?
There is no known exploitation of CVE-2001-1016 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cg3c-pj78-hrh5.