[17181] in bugtraq
GPG 1.0.3 doesn't detect modifications to files with multiple
daemon@ATHENA.MIT.EDU (Jim Small)
Thu Oct 12 15:12:34 2000
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
Mime-Version: 1.0
Message-ID: <200010111930.MAA03505@mail14.bigmailbox.com>
Date: Wed, 11 Oct 2000 12:30:19 -0700
Reply-To: Jim Small <cavenewt@MY-DEJA.COM>
From: Jim Small <cavenewt@MY-DEJA.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
Attached is multiple copies of a file I had signed. Then I started modifying parts of the SIGNED message. To see if gpg could detect that the messages had been altered. It did not detect them, so long as the last signed message had not been altered.
Save this message as newfile.asc and run
gpg --verify newfile.asc -o /dev/null
to see for yourself (the key it was signed with is available via keyservers)
asdfasfasdfd
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I just added by one stuff to thie message
bogugfirst file encrypted with nobody dude on uinix box, send to nethole forpmail
this is actually encrypted with a valid pgpg key imported form win95
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.3 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE538QlZi9y1BQncn4RAj/vAKCmfScBFegl6LMD3Q99N51pvuHAIQCfUv5+ a05Yt6xZwd/PxtQsRe+88AQ=
=siBR
-----END PGP SIGNATURE-----
middle stuff
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
another wrong
first file encrypted with nobody dude on uinix box, send to nethole forpmail
this is actually encrypted with a valid pgpg key imported form win95
another file
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.3 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE538hvZi9y1BQncn4RAolnAKCwEJTyPm6895ybQfk1D5IfeqJjmwCg4MlP 3NbvJocg5ksql40aOTZf0MY=
=yBf2
-----END PGP SIGNATURE-----
asfasfasf end stuff
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
first file encrypted with nobody dude on uinix box, send to nethole forpmail
this is actually encrypted with a valid pgpg key imported form win95
bogud
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.3 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE538QlZi9y1BQncn4RAj/vAKCmfScBFegl6LMD3Q99N51pvuHAIQCfUv5+ a05Yt6xZwd/PxtQsRe+88AQ=
=siBR
-----END PGP SIGNATURE-----
stuff
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
first file encrypted with nobody dude on uinix box, send to nethole forpmail
this is actually encrypted with a valid pgpg key imported form win95
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.3 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE538QlZi9y1BQncn4RAj/vAKCmfScBFegl6LMD3Q99N51pvuHAIQCfUv5+ a05Yt6xZwd/PxtQsRe+88AQ=
=siBR
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
first file encrypted with nobody dude on uinix box, send to nethole forpmail
this is actually encrypted with a valid pgpg key imported form win95
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.3 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE538QlZi9y1BQncn4RAj/vAKCmfScBFegl6LMD3Q99N51pvuHAIQCfUv5+ a05Yt6xZwd/PxtQsRe+88AQ=
=siBR
-----END PGP SIGNATURE-----
gpg: Signature made Sat Oct 7 17:47:33 2000 PDT using DSA key ID 1427727E
gpg: Good signature from "James F. Small, Jr. <smallj@nethole.com>" gpg: aka "Jim Small <smallj@pacbell.net>" gpg: aka "James F. Small, Jr. <smallj@saic.com>" gpg: aka "James F. Small, Jr. <smallj@small.cx>" gpg: Signature made Sat Oct 7 18:05:51 2000 PDT using DSA key ID 1427727E
gpg: BAD signature from "James F. Small, Jr. <smallj@nethole.com>" gpg: Signature made Sat Oct 7 17:47:33 2000 PDT using DSA key ID 1427727E
gpg: Good signature from "James F. Small, Jr. <smallj@nethole.com>" gpg: aka "Jim Small <smallj@pacbell.net>" gpg: aka "James F. Small, Jr. <smallj@saic.com>" gpg: aka "James F. Small, Jr. <smallj@small.cx>" gpg: Signature made Sat Oct 7 17:47:33 2000 PDT using DSA key ID 1427727E
gpg: Good signature from "James F. Small, Jr. <smallj@nethole.com>" gpg: aka "Jim Small <smallj@pacbell.net>" gpg: aka "James F. Small, Jr. <smallj@saic.com>" gpg: aka "James F. Small, Jr. <smallj@small.cx>" gpg: Signature made Sat Oct 7 17:47:33 2000 PDT using DSA key ID 1427727E
gpg: Good signature from "James F. Small, Jr. <smallj@nethole.com>" gpg: aka "Jim Small <smallj@pacbell.net>" gpg: aka "James F. Small, Jr. <smallj@saic.com>" gpg: aka "James F. Small, Jr. <smallj@small.cx>"
------------------------------------------------------------
--== Sent via Deja.com http://www.deja.com/ ==--
Before you buy.
