PGP SDA security flaw question

[PGPee]

Does anyone know the truth on the "alleged" security flaw in PGP SDA? The
hackers say it can be broken, but PGP says what the hackers found is
something that can be expected and is not a security risk. So what's the
deal?

[David W. Hodgins]

Post by PGPee
Does anyone know the truth on the "alleged" security flaw in PGP SDA? The
hackers say it can be broken, but PGP says what the hackers found is
something that can be expected and is not a security risk. So what's the
deal?

If you're referring to
http://homepage.mac.com/adonismac/Advisory/pgp/PGPcrack.html

You need update access to replace an sda with one you've created.

This only matters for authentication issues. Anyone can write
a program that looks like an sda, and puts out similar output
to what a real sda would. If you don't trust the source of
the files you've gotten, don't run them.

For the Virtual disk, it allows anyone with write access to the
raw device to format it. So what! They can do that anyway.

I don't see how this is a flaw.

Regards, Dave Hodgins

[David E. Ross]

Post by PGPee
Does anyone know the truth on the "alleged" security flaw in PGP SDA? The
hackers say it can be broken, but PGP says what the hackers found is
something that can be expected and is not a security risk. So what's the
deal?

This is a very old story, reported as far back as 2006 if not earlier.
I cannot find any reference to this in any authoritative source (e.g.,
Mitre Corporation's Common Vulnerabilities and Exposures, Carnegie
Mellon's CERT, Department of Homeland Security's US-CERT).

I did find several items via Google that seem to refute the claims about
the flaw. See for example
<http://www.mail-archive.com/***@metzdowd.com/msg06530.html>.