PGP Key Server Flaw Opens Door to Attackers

PGP Key Server Flaw Opens Door to Attackers

Written By
Dennis Fisher
Dennis Fisher
Oct 1, 2001
1 minute read
eWeek content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

Security researchers have found a flaw in a popular digital-certificate management product that could enable an attacker to access a remote key server without having to enter a username or password.

The vulnerability in PGP Key Server 7.0 enables an attacker to make configuration changes to the server but does not give him access to the stored keys or any of the data that those keys protect.

By entering a malformed Web URL, an attacker can bypass the usual authentication mechanism needed to access the Key Server administrative interface. The attacker could then reconfigure the server, including disabling it entirely, according to a bulleting released by PGP, a division of Network Associates Inc., in Santa Clara, Calif.

The flaw affects only Version 7.0 of Key Server but is found in both the Windows NT and Solaris versions.

Key Server is a certificate storage and management package that is used in conjunction with encryption software to manage the use and distribution of digital certificates.

PGP has posted to its Web site a fix for the new vulnerability.

eWeek Logo

eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site's focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

Property of TechnologyAdvice. © 2026 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.