CVE-2001-1320: PGP Keyserver 7.0 LDAP BER encoding crash and possible code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated, low-complexity flaw with partial confidentiality, integrity and availability impact and a high EPSS score, though no confirmed in-the-wild exploitation is recorded.

What it is

Network Associates PGP Keyserver 7.0 mishandles exceptional BER encodings, causing a crash and possibly allowing arbitrary code execution, likely through buffer overflows. The issue was demonstrated by the PROTOS LDAPv3 test suite, which means malformed LDAP traffic is enough to trigger it. It matters because a keyserver is a network-facing service and the flaw can take it down or, per the description, lead to code execution.

Impact

An attacker can crash the keyserver, causing denial of service, and may be able to execute arbitrary code in the keyserver process. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.

Attack surface

Reached remotely over the network via LDAP/BER-encoded requests to the keyserver; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The description does not specify which port or interface, only that the input is exceptional BER encodings.

Exploitation

Not listed in CISA KEV and no ransomware use is documented. EPSS is high (0.68324, 99.3rd percentile), and references include CERT/CC and CIAC advisories plus a vendor patch, but no public exploit code is confirmed in the record.

What to do

• Apply the vendor patch referenced in the CIAC bulletin and CERT/CC advisory for PGP Keyserver 7.0.
• If patching is not possible, restrict network access to the keyserver's LDAP service to trusted hosts only.
• Run the keyserver with least privilege and isolate it from other services to limit impact of code execution.
• Monitor vendor and CERT/CC advisories for updated guidance, since the record is old and may not reflect current support status.

Detection

• Monitor keyserver logs for crashes, restarts or abnormal termination of the LDAP service.
• Inspect network traffic for malformed or exceptional BER/LDAP encodings directed at the keyserver.
• Alert on repeated connection attempts or fuzzing-like LDAP payloads from single sources.
• Track process-level crashes of the keyserver binary and correlate with inbound LDAP requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.