SERIOUS PGP BUG!

[Phosgene <phosgene () SETEC ORG>]

In case you have not heard there is a serious bug in some versions of PGP
related to additonal decryption keys (ADK).
For more information look at John Young's site which details some of this:
http://cryptome.org/pgp-badbug.htm

Quoting from an email on the site:

"Tested versions of PGP:
PGP-2.6.3ia UNIX   (not vulnerable - doesn't support V4 signatures)
PGP-5.0i UNIX      (not vulnerable)
PGP-5.5.3i WINDOWS (VULNERABLE)
PGP-6.5.1i WINDOWS (VULNERABLE)
GnuPG-1.0.1 UNIX   (not vulnerable)"

A paper detailing an aspect of the vulnerability is written by Ralf
Senderek: http://senderek.de/security/key-experiments.html and his student
Stephen Early <Stephen.Early () cl cam ac uk> seems to have worked on
detailing this vulnerability as well on the ukcrypto mailing list.

Phosgene