Vulnerability

    PGP

Affected

    PGP 7.0

Description

    Michael  Kjorling  found  following.   Users  with write access to
    signed exported key  blocks may replace  them with arbitrary  keys
    without any warning being issued upon import of those keys

    There seems to be  a vulnerability in the  key import code in  PGP
    7.0 on  the Win32/Intel  platform, causing  a signature  on a full
    exported  and  ASCII  armored  key  block  not  to be checked when
    "Decrypt/Verify" is  selected to  import the  key(s).   This means
    that any signatures on the full exported key block is not checked,
    opening the possibility  for anyone who  have write access  to the
    file  to  replace  the  keys  without  having  to  generate  a new
    signature.  Key signature  verification, however, is not  affected
    by this vulnerability.

    Given the possibility to write  to the PGP signed file  containing
    the  exported  key(s),  replace  the  keys  without  altering  the
    signature.  PGP  will not warn  the user upon  import of the  keys
    that the signature has become invalid.  Man-in-the-middle  attacks
    are also  a possibility,  given an  eavesdropper listening  on the
    communications channel and replacing the key material as it  flows
    through the wires.

Solution

    There   is   no   known   workaround,   besides  always  verifying
    fingerprints with  the owner  of the  key as  well as not trusting
    keys that have no or just a few signatures.

    Network  Associates  was  contacted  by  email as per instructions
    from their support department on December 20th, 2000.