[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: pgp in Debian: obsolete?

* Ian Beckwith:

> On Sat, Aug 07, 2004 at 09:17:38PM +0200, Florian Weimer wrote:
>> Both PGP 5 and 6.5 have security issues which haven't been fixed
>> upstream (because there isn't any upstream anymore).  There are some
>> pirated versions of 6.5.8 that incorporate fixes, but Debian certainly
>> shouldn't encourage distribution of them.
> Hmm.
> Do you have links to documentation of these issues

IIRC, there's a buffer overflow in the UID handling that has never
been published.  Then there's the Klima-Rosa attack, the lack of an
MDC (Modification Detection Code), and one or more user ID handling
bugs (see <http://www.bluering.nl/pgp/useridbug.txt>).

I once worked on an OpenPGP implementation vulnerability matrix, but
this topic isn't very interesting anymore.  For me at least, there's
just GnuPG.

Reply to: