Is this a zip encryption bug?
up vote
1
down vote
favorite
I have recently discovered an exploit, where I(or assuming anyone) can re-encrypt my encrypted zip file without having to know the password:
#zip --encrypt encrypted.zip -r dir1/
The above will prompt the user to enter a new password. Is there something I'm missing, or is this a known issue?
encryption zip
asked 3 hours ago
lamino
113
New contributor
lamino is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
up vote
1
down vote
favorite
I have recently discovered an exploit, where I(or assuming anyone) can re-encrypt my encrypted zip file without having to know the password:
#zip --encrypt encrypted.zip -r dir1/
The above will prompt the user to enter a new password. Is there something I'm missing, or is this a known issue?
encryption zip
asked 3 hours ago
lamino
113
New contributor
lamino is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Have you found a way to read the data in the original zip file?
– ctrl-alt-delor
2 hours ago
@ctrl-alt-delor yes I didn't forget my password, I realised this by accident
– lamino
2 hours ago
1
Sorry I meant, Have you found a way to read the data in the original zip file, without knowing the password?
– ctrl-alt-delor
2 hours ago
add a comment |
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I have recently discovered an exploit, where I(or assuming anyone) can re-encrypt my encrypted zip file without having to know the password:
#zip --encrypt encrypted.zip -r dir1/
The above will prompt the user to enter a new password. Is there something I'm missing, or is this a known issue?
encryption zip
asked 3 hours ago
lamino
113
New contributor
lamino is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I have recently discovered an exploit, where I(or assuming anyone) can re-encrypt my encrypted zip file without having to know the password:
#zip --encrypt encrypted.zip -r dir1/
The above will prompt the user to enter a new password. Is there something I'm missing, or is this a known issue?
encryption zip
encryption zip
asked 3 hours ago
lamino
113
New contributor
lamino is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 3 hours ago
lamino
113
New contributor
lamino is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 3 hours ago
lamino
113
New contributor
lamino is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 3 hours ago
lamino
113
asked 3 hours ago
lamino
113
113
New contributor
lamino is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
lamino is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
lamino is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Have you found a way to read the data in the original zip file?
– ctrl-alt-delor
2 hours ago
@ctrl-alt-delor yes I didn't forget my password, I realised this by accident
– lamino
2 hours ago
1
Sorry I meant, Have you found a way to read the data in the original zip file, without knowing the password?
– ctrl-alt-delor
2 hours ago
add a comment |
Have you found a way to read the data in the original zip file?
– ctrl-alt-delor
2 hours ago
@ctrl-alt-delor yes I didn't forget my password, I realised this by accident
– lamino
2 hours ago
1
Sorry I meant, Have you found a way to read the data in the original zip file, without knowing the password?
– ctrl-alt-delor
2 hours ago
Have you found a way to read the data in the original zip file?
– ctrl-alt-delor
2 hours ago
Have you found a way to read the data in the original zip file?
– ctrl-alt-delor
2 hours ago
@ctrl-alt-delor yes I didn't forget my password, I realised this by accident
– lamino
2 hours ago
@ctrl-alt-delor yes I didn't forget my password, I realised this by accident
– lamino
2 hours ago
1
1
Sorry I meant, Have you found a way to read the data in the original zip file, without knowing the password?
– ctrl-alt-delor
2 hours ago
Sorry I meant, Have you found a way to read the data in the original zip file, without knowing the password?
– ctrl-alt-delor
2 hours ago
add a comment |
1 Answer
1
active
oldest
votes
up vote
5
down vote
accepted
Zip archives can have multiple passwords for different contained files. Files within an archive are essentially independent of each other - they are compressed without regard for other files, and they are encrypted in the same fashion. Your encrypted.zip will have two (or more) encrypted segments, one with your original password and one with the new one.
Trying to unzip the file would prompt for both passwords:
$ unzip ../test.zip
Archive: ../test.zip
[../test.zip] file1 password:
inflating: file1
inflating: file2
[../test.zip] newfile password:
inflating: newfile
The directory, the listing of file names, is not encrypted. This is not a bug, though it can be confusing and not all zip tools handle the situation well (particularly graphical tools).
answered 3 hours ago
Michael Homer
45.2k7119159
Counter-intuitive but Interesting feature. Thanks for clarifying
– lamino
2 hours ago
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
lamino is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f489757%2fis-this-a-zip-encryption-bug%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
5
down vote
accepted
Zip archives can have multiple passwords for different contained files. Files within an archive are essentially independent of each other - they are compressed without regard for other files, and they are encrypted in the same fashion. Your encrypted.zip will have two (or more) encrypted segments, one with your original password and one with the new one.
Trying to unzip the file would prompt for both passwords:
$ unzip ../test.zip
Archive: ../test.zip
[../test.zip] file1 password:
inflating: file1
inflating: file2
[../test.zip] newfile password:
inflating: newfile
The directory, the listing of file names, is not encrypted. This is not a bug, though it can be confusing and not all zip tools handle the situation well (particularly graphical tools).
answered 3 hours ago
Michael Homer
45.2k7119159
Counter-intuitive but Interesting feature. Thanks for clarifying
– lamino
2 hours ago
add a comment |
up vote
5
down vote
accepted
Zip archives can have multiple passwords for different contained files. Files within an archive are essentially independent of each other - they are compressed without regard for other files, and they are encrypted in the same fashion. Your encrypted.zip will have two (or more) encrypted segments, one with your original password and one with the new one.
Trying to unzip the file would prompt for both passwords:
$ unzip ../test.zip
Archive: ../test.zip
[../test.zip] file1 password:
inflating: file1
inflating: file2
[../test.zip] newfile password:
inflating: newfile
The directory, the listing of file names, is not encrypted. This is not a bug, though it can be confusing and not all zip tools handle the situation well (particularly graphical tools).
answered 3 hours ago
Michael Homer
45.2k7119159
Counter-intuitive but Interesting feature. Thanks for clarifying
– lamino
2 hours ago
add a comment |
up vote
5
down vote
accepted
up vote
5
down vote
accepted
Zip archives can have multiple passwords for different contained files. Files within an archive are essentially independent of each other - they are compressed without regard for other files, and they are encrypted in the same fashion. Your encrypted.zip will have two (or more) encrypted segments, one with your original password and one with the new one.
Trying to unzip the file would prompt for both passwords:
$ unzip ../test.zip
Archive: ../test.zip
[../test.zip] file1 password:
inflating: file1
inflating: file2
[../test.zip] newfile password:
inflating: newfile
The directory, the listing of file names, is not encrypted. This is not a bug, though it can be confusing and not all zip tools handle the situation well (particularly graphical tools).
answered 3 hours ago
Michael Homer
45.2k7119159
Zip archives can have multiple passwords for different contained files. Files within an archive are essentially independent of each other - they are compressed without regard for other files, and they are encrypted in the same fashion. Your encrypted.zip will have two (or more) encrypted segments, one with your original password and one with the new one.
Trying to unzip the file would prompt for both passwords:
$ unzip ../test.zip
Archive: ../test.zip
[../test.zip] file1 password:
inflating: file1
inflating: file2
[../test.zip] newfile password:
inflating: newfile
The directory, the listing of file names, is not encrypted. This is not a bug, though it can be confusing and not all zip tools handle the situation well (particularly graphical tools).
answered 3 hours ago
Michael Homer
45.2k7119159
answered 3 hours ago
Michael Homer
45.2k7119159
answered 3 hours ago
Michael Homer
45.2k7119159
answered 3 hours ago
Michael Homer
45.2k7119159
45.2k7119159
Counter-intuitive but Interesting feature. Thanks for clarifying
– lamino
2 hours ago
add a comment |
Counter-intuitive but Interesting feature. Thanks for clarifying
– lamino
2 hours ago
Counter-intuitive but Interesting feature. Thanks for clarifying
– lamino
2 hours ago
Counter-intuitive but Interesting feature. Thanks for clarifying
– lamino
2 hours ago
add a comment |
lamino is a new contributor. Be nice, and check out our Code of Conduct.
lamino is a new contributor. Be nice, and check out our Code of Conduct.
lamino is a new contributor. Be nice, and check out our Code of Conduct.
lamino is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f489757%2fis-this-a-zip-encryption-bug%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Have you found a way to read the data in the original zip file?
– ctrl-alt-delor
2 hours ago
@ctrl-alt-delor yes I didn't forget my password, I realised this by accident
– lamino
2 hours ago
1
Sorry I meant, Have you found a way to read the data in the original zip file, without knowing the password?
– ctrl-alt-delor
2 hours ago