EncFS Flawed CBC/CFB Cryptography Implementation Weaknesses
BID:42779
Info
EncFS Flawed CBC/CFB Cryptography Implementation Weaknesses
| Bugtraq ID: | 42779 |
| Class: | Design Error |
| CVE: |
CVE-2010-3073 CVE-2010-3074 CVE-2010-3075 |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 26 2010 12:00AM |
| Updated: | Apr 16 2015 06:14PM |
| Credit: | Micha Riser |
| Vulnerable: |
SuSE openSUSE 11.3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 EncFS EncFS 1.6.0 |
| Not Vulnerable: | |
Discussion
EncFS Flawed CBC/CFB Cryptography Implementation Weaknesses
EncFS is prone to design errors in its cryptographic implementation.
Three flaws have been identified that contribute to a weakening of the protections provided under CBC/CFB cipher mode.
Attackers may leverage these weaknesses to attack encrypted files through watermarking or other techniques. Successful attacks may disclose sensitive information.
EncFS is prone to design errors in its cryptographic implementation.
Three flaws have been identified that contribute to a weakening of the protections provided under CBC/CFB cipher mode.
Attackers may leverage these weaknesses to attack encrypted files through watermarking or other techniques. Successful attacks may disclose sensitive information.
Exploit / POC
EncFS Flawed CBC/CFB Cryptography Implementation Weaknesses
The following proof-of-concept is available:
The following proof-of-concept is available:
Solution / Fix
EncFS Flawed CBC/CFB Cryptography Implementation Weaknesses
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
EncFS Flawed CBC/CFB Cryptography Implementation Weaknesses
References:
References:
- EncFS Homepage (EncFS)
- Multiple Vulnerabilities in EncFS (Micha Riser
)