Anubis Plugin for encrypt Original File Size Information Disclosure Weakness

Bugtraq ID:	29378
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 26 2008 12:00AM
Updated:	May 26 2008 12:00AM
Credit:	The vendor disclosed this issue.
Vulnerable:	albinoloverats Anubis Plugin for encrypt 0
Not Vulnerable:	albinoloverats Anubis Plugin for encrypt 1.3

Anubis Plugin for encrypt Original File Size Information Disclosure Weakness

The Anubis plugin for 'encrypt' is prone to an information-disclosure weakness because the software fails to properly safeguard potentially sensitive information.

Successfully gaining access to the exposed information may aid attackers in performing cryptanalysis on encrypted file contents. This may aid in further attacks.

Versions prior to Anubis 1.3 are affected.

Anubis Plugin for encrypt Original File Size Information Disclosure Weakness

To obtain the file size information, the attacker doesn't need specific exploit code. The attacker would likely need custom exploit code to perform cryptanalysis with the obtained information.

Anubis Plugin for encrypt Original File Size Information Disclosure Weakness

Solution:
The vendor has released a new version of the affected package to address this issue. Please see the references for more information.


albinoloverats Anubis Plugin for encrypt 0

• albinoloverats anubis-1.3.tar.bz2
  http://downloads.sourceforge.net/encrypt/anubis-1.3.tar.bz2?use_mirror =osdn

Anubis Plugin for encrypt Original File Size Information Disclosure Weakness

References:

• Anubis Plugin Product Page (albinoloverats)
  
• Anubis+Ripe160 1.3 (albinoloverats)