CryptoBuddy Unused Encryption Passphrase Vulnerability
BID:6812
Info
CryptoBuddy Unused Encryption Passphrase Vulnerability
| Bugtraq ID: | 6812 |
| Class: | Design Error |
| CVE: |
CVE-2003-1392 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 10 2003 12:00AM |
| Updated: | Jul 06 2016 02:06PM |
| Credit: | The discovery of this vulnerability has been credited to [email protected]. |
| Vulnerable: |
Research Triangle Software CryptoBuddy 1.2.2 Research Triangle Software CryptoBuddy 1.2 Research Triangle Software CryptoBuddy 1.0 Research Triangle Software CryptoBuddy 1.0 |
| Not Vulnerable: | |
Discussion
CryptoBuddy Unused Encryption Passphrase Vulnerability
A vulnerability has been reported for CryptoBuddy that may result in attackers intercepting and decoding encrypted information. The vulnerability exists because CryptoBuddy does not use the user-supplied passphrase to encrypt files. Instead, the passphrase is encrypted and stored at a known offset in the encrypted file. It is likely that the passphrase is tested and used to initiate the decryption of the data using the CryptoBuddy algorithm.
By modifying the contents of an encrypted file it is possible for an attacker to use their own encrypted passphrase to decrypt the contents. An attacker can exploit this vulnerability by creating a passphrase and replacing the passphrase located in an encrypted file, at a known offset, with their own. By using CryptoBuddy to decrypt the file, the attacker-supplied passphrase could then be supplied to initiate the decryption.
Exploitation of this vulnerability may result in the disclosure of sensitive information.
A vulnerability has been reported for CryptoBuddy that may result in attackers intercepting and decoding encrypted information. The vulnerability exists because CryptoBuddy does not use the user-supplied passphrase to encrypt files. Instead, the passphrase is encrypted and stored at a known offset in the encrypted file. It is likely that the passphrase is tested and used to initiate the decryption of the data using the CryptoBuddy algorithm.
By modifying the contents of an encrypted file it is possible for an attacker to use their own encrypted passphrase to decrypt the contents. An attacker can exploit this vulnerability by creating a passphrase and replacing the passphrase located in an encrypted file, at a known offset, with their own. By using CryptoBuddy to decrypt the file, the attacker-supplied passphrase could then be supplied to initiate the decryption.
Exploitation of this vulnerability may result in the disclosure of sensitive information.
Exploit / POC
CryptoBuddy Unused Encryption Passphrase Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
CryptoBuddy Unused Encryption Passphrase Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.