FKIE_CVE-2010-3618

Vulnerability from fkie_nvd - Published: 2010-11-22 13:00 - Updated: 2026-06-16 23:23
Severity
Summary
PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an additional message to the end of a legitimately signed message, related to a "piggy-back" or "unsigned data injection" issue.
References
cret@cert.orghttp://secunia.com/advisories/42293
cret@cert.orghttp://secunia.com/advisories/42307
cret@cert.orghttp://www.cs.ru.nl/E.Verheul/papers/Govcert/Pretty%20Good%20Piggybagging%20v1.0.pdfExploit
cret@cert.orghttp://www.kb.cert.org/vuls/id/300785US Government Resource
cret@cert.orghttp://www.securitytracker.com/id?1024760
cret@cert.orghttp://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20101118_00
cret@cert.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/63366
cret@cert.orghttps://pgp.custhelp.com/app/answers/detail/a_id/2290Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/42293
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/42307
af854a3a-2127-422b-91ae-364da2661108http://www.cs.ru.nl/E.Verheul/papers/Govcert/Pretty%20Good%20Piggybagging%20v1.0.pdfExploit
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/300785US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1024760
af854a3a-2127-422b-91ae-364da2661108http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20101118_00
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/63366
af854a3a-2127-422b-91ae-364da2661108https://pgp.custhelp.com/app/answers/detail/a_id/2290Vendor Advisory
Impacted products
Vendor Product Version
pgp desktop_for_windows *
pgp desktop_for_windows 10.0.0
pgp desktop_for_windows 10.0.1
pgp desktop_for_windows 10.0.2
pgp desktop_for_windows 10.0.3
pgp desktop_for_windows 10.1.0
pgp desktop_for_mac *
pgp desktop_for_mac 10.0.0
pgp desktop_for_mac 10.0.1
pgp desktop_for_mac 10.0.2
pgp desktop_for_mac 10.0.3
pgp desktop_for_mac 10.1.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cret@cert.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_windows:*:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "4C31E564-9B67-4781-A3CD-4E96E001AEF7",
              "versionEndIncluding": "10.0.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_windows:10.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "54B53739-ED0F-4047-B9EB-4C20CA010CEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_windows:10.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CD36FF7-E6AC-4380-A3DE-AC3EC59F87F4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_windows:10.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "134129E3-BA39-4AD7-880B-F8A9D0E627D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_windows:10.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "764F03DE-08B4-4FF4-8486-57C74F35A153",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_windows:10.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "42581FB8-881D-4530-8478-8868202C16FC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_mac:*:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "F4150689-14B7-49BE-B69B-0C3339A83B26",
              "versionEndIncluding": "10.0.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_mac:10.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "860A95E9-4258-44D7-BCBD-FE4FF90011A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_mac:10.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF9B04EA-A94A-4815-B38D-689AE3EA5328",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_mac:10.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2826C6CC-DBD2-41AC-A8B2-8B552571FBCC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_mac:10.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "95337EB9-7275-449C-BC7F-1D8ACF30FDB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pgp:desktop_for_mac:10.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6B40A84-5672-4980-9494-21B82D276ED3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the \"Decrypt/Verify File via Right-Click\" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an additional message to the end of a legitimately signed message, related to a \"piggy-back\" or \"unsigned data injection\" issue."
    },
    {
      "lang": "es",
      "value": "PGP Desktop v10.0.x anterior a v10.0.3 SP2 y v10.1.0 anterior a v10.1.0 SP1 no implementa adecuadamente la funcionalidad \"Descifrar/Verificar archivo a trav\u00e9s de Clic-Derecho\" para mensajes OpenPGP multi-empaquetados que representan entradas multi-mensaje, lo que premite a atacantes remotos falsear datos firmados concatenando un mensaje adicional al final del mensaje firmado legitimamente, relacionado con un fallo \"piggy-back\" o \"inyecci\u00f3n de datos sin firmar\"."
    }
  ],
  "id": "CVE-2010-3618",
  "lastModified": "2026-06-16T23:23:09.073",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2010-11-22T13:00:16.957",
  "references": [
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/42293"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/42307"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.cs.ru.nl/E.Verheul/papers/Govcert/Pretty%20Good%20Piggybagging%20v1.0.pdf"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/300785"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.securitytracker.com/id?1024760"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=2010\u0026suid=20101118_00"
    },
    {
      "source": "cret@cert.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/63366"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://pgp.custhelp.com/app/answers/detail/a_id/2290"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/42293"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/42307"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.cs.ru.nl/E.Verheul/papers/Govcert/Pretty%20Good%20Piggybagging%20v1.0.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/300785"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1024760"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=2010\u0026suid=20101118_00"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/63366"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://pgp.custhelp.com/app/answers/detail/a_id/2290"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.