Description
GnuPG (gpg) 1.0.3 does not properly check all signatures of a file containing multiple documents, which allows an attacker to modify contents of all documents but the first without detection.
References
- 20001011 GPG 1.0.3 doesn't detect modifications to files with multiple signatures mailing-list
- 20001025 Immunix OS Security Update for gnupg package mailing-list
- 20001111 gnupg: incorrect signature verification vendor-advisory
- gnupg-message-modify(5386) vdb-entry
- RHSA-2000:089 vendor-advisory
- CLSA-2000:334 vendor-advisory
- 1797 vdb-entry
- 1608 vdb-entry