Slashdot Mirror
Security Flaw Discovered in GPG
WeLikeRoy writes "A serious problem in the use of GPG to verify digital signatures has been discovered, which also affects the use of gpg in email. It is possible for an attacker to take any signed message and inject extra arbitrary data without affecting the signed status of the message. Depending on how gpg is invoked, it may be possible to output just faked data as several variants of this attack have been discovered. All versions of gnupg prior to 1.4.2.2 are affected, and it is thus recommended to update GnuPG as soon as possible to version 1.4.2.2."
A serious security issue in GPG! We are all doomed!
;)
what is GPG?
Yeah, I will go RTFA. However, summaries that assume you are familiar with an acronym are rude, IMHO
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Its a good thing I don't use GPG to sign my emails. Oh wait.
For all the tinfoil hat people out there, I propose that the bug may have been placed intentionally, since GnuPG is, in fact, an opensource community project. So instead of taking hours to obtain a GPG key, the NSA could spend seconds and impersonate an otherwise [strike]paranoid[/strike] privacy-oriented person in typically confidential memos. Maybe a full accounting as to when the bug got there, how it got there, who put it there and the chances of it being purely human error are to be demanded? After all, some people (including myself) have invested some very expensive stakes in the security of GnuPG over the years.
HopeSeekr of xMule
Promote freedom; fight fascism.
that GPG user lives downstairs i'll just tell him there is a problem
Sound like a movie rating.
She thought she could get rid of me with that rejection via email. Now I've got reasonable doubt about her feelings. Until I get that court order, of course.
End transmission.
Don't you think they're smart enough to think that you would think they weren't that stupid?
rewriting history since 2109
I'm not even smart enough to understand what you just said.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
That information should never have been released! The negative press will impact sales. It would have been better to pretend the bug never existed.
Oh, it isn't corporate product, nevermind.
did anybody cross-check the authenticity of that warning? I wont accept that until I verify its GPG key :)
That's an awesome idea. I'm going to start doing that right now! :P
application/x-pkcs7-signature; name="smime.p7s"
I was told that I could listen to the radio at a reasonable volume from nine to eleven...
I'm tired of their insecure crap! Oh wait, its GNU open source? In that case, you lazy bastard end users should have fixed it yourself!
Better assign a security Czar!
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Mod parent up, since he's right...
How in the F*** did THAT make it through the lameness filters?!
There is a fine line between being a cultivated citizen and being someone else's crop. - A. J. Patrick Liszkie
Dear Alice,
Have you heard? GPG has a bug in it that lets people append data to a signed email message! What are we going to do to stop Malory from attacking us?
Sincerely,
Bob
PS. Jus7 k!dd!ng! 1ts n0t 7ru3! I'm t@lk!ng thr0ugh my @$$!! LOLOLOLOLOL