| gabriel rosenkoetter on Wed, 12 Mar 2003 20:34:10 -0500 |
|
For those of you using the commercial PGP. Pretty boneheaded, since creating a hash including the OLE file is trivial, it'd make sense to just do it and forget about it. (SHA1 doesn't care what your "format" your bits are...) -- gabriel rosenkoetter gr@eclipsed.net ----- Forwarded message from Thomas Shaddack <shaddack@ns.arachne.cz> ----- From: Thomas Shaddack <shaddack@ns.arachne.cz> Subject: Potential PGP signature verification problem? (fwd) Date: Wed, 12 Mar 2003 21:43:04 +0100 (CET) To: cypherpunks <cypherpunks@lne.com> Delivered-To: gr@eclipsed.net X-Authentication-Warning: hq.pro-ns.net: majordom set sender to owner-cypherpunks@ds.pro-ns.net using -f X-Authentication-Warning: slack.lne.com: majordom set sender to owner-cypherpunks@lne.com using -f X-X-Sender: <shad@Zeta> X-Loop: cypherpunks@lne.com X-spam: 0 Precedence: bulk X-Loop: ds.pro-ns.net This could be of interest for y'all. An important caveat for crypto use. ---------- Forwarded message ---------- Date: 12 Mar 2003 19:59:30 -0000 Subject: Potential PGP signature verification problem? From: Avri Schneider <avri_schneider@yahoo.com> To: bugtraq@securityfocus.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I have come across a possible problem in the way PGP handles signature verification. The problem lies in the fact that PGP will strip OLE objects inserted in an e-mail and verify the message signature based only on the text, not informing the user that objects were striped. A WordPad document can be inserted in the e-mail as an OLE object, having the same font style and size as the original message. An attacker would take a signed message and insert such word document anywhere in the message as an OLE object and when the recepient checks the signature - the wordpad document is stripped and the signature would be valid - The attack would only work if the recepient does not use the pgp verified message "text viewer" dialog box to read the message but uses it only to verify the validity of the signature. This was tested with pgp.com's PGP version 8.0, other versions may be vulnerable as well. I have experimented with older versions and they only worked in the hash field of the PGP header which is stripped before the message is verified and the same attack can be performed but text would only be added at the beginning of the message. Regards, Avri Schneider http://pgp.mit.edu 0x44F87D04 -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 - not licensed for commercial use: www.pgp.com iQA/AwUBPm0AKGelhJFE+H0EEQIyxACg7HTH5UjaSGy5D3cobYx0h6io1lsAnRk1 cWnPtLBNw3G3XBkZuuUXPgIg =fWay -----END PGP SIGNATURE----- ----- End forwarded message ----- Attachment:
pgpuDiEJh4nnR.pgp
|
|