VTun ECB Mode Encryption Vulnerabilities
BID:3845
Info
VTun ECB Mode Encryption Vulnerabilities
| Bugtraq ID: | 3845 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 09 2002 12:00AM |
| Updated: | Jan 09 2002 12:00AM |
| Credit: | Published by Jerome Etienne <[email protected]>. |
| Vulnerable: |
VTun VTun 2.5 b1 VTun VTun 2.4 VTun VTun 2.3 VTun VTun 2.2 VTun VTun 2.1 VTun VTun 2.0 |
| Not Vulnerable: | |
Discussion
VTun ECB Mode Encryption Vulnerabilities
VTun is a Virtual Private Network (VPN) daemon designed for Linux and Unix based systems. It acts as a tunnel for a network interface, and embeds all communication into a TCP stream after encryption is applied. This allows private network communication to occur through a larger network. VTun uses the Blowfish encryption algorithm in electronic code book (ECB) mode. The encryption key is derived from a shared secret defined when VTun is configured.
Fundamental properties of ECB mode ciphers may have an impact on the security of VTun based communications. An attacker may be able to detect repeated patterns in communication, as identical plaintext blocks will result in identical encrypted blocks. An attacker able to modify the data in transit may also mount a replay attack, possibly subverting the communication without breaking the underlying encryption.
VTun is a Virtual Private Network (VPN) daemon designed for Linux and Unix based systems. It acts as a tunnel for a network interface, and embeds all communication into a TCP stream after encryption is applied. This allows private network communication to occur through a larger network. VTun uses the Blowfish encryption algorithm in electronic code book (ECB) mode. The encryption key is derived from a shared secret defined when VTun is configured.
Fundamental properties of ECB mode ciphers may have an impact on the security of VTun based communications. An attacker may be able to detect repeated patterns in communication, as identical plaintext blocks will result in identical encrypted blocks. An attacker able to modify the data in transit may also mount a replay attack, possibly subverting the communication without breaking the underlying encryption.
Exploit / POC
VTun ECB Mode Encryption Vulnerabilities
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
VTun ECB Mode Encryption Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.