Vulnerability Description
EncFS before 1.7.0 encrypts multiple blocks by means of the CFB cipher mode with the same initialization vector, which makes it easier for local users to obtain sensitive information via calculations involving recovery of XORed data, as demonstrated by an attack on encrypted data in which the last block contains only one byte.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Arg0 | Encfs | <= 1.6.0 |
Related Weaknesses (CWE)
References
- http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047794.
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047798.
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047825.
- http://secunia.com/advisories/41158Vendor Advisory
- http://secunia.com/advisories/41478Vendor Advisory
- http://www.arg0.net/encfs
- http://www.openwall.com/lists/oss-security/2010/09/05/3
- http://www.openwall.com/lists/oss-security/2010/09/06/1
- http://www.openwall.com/lists/oss-security/2010/09/07/8
- http://www.vupen.com/english/advisories/2010/2414Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=630460
- http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047794.
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047798.
FAQ
What is CVE-2010-3075?
CVE-2010-3075 is a vulnerability with a CVSS score of 5.0 (MEDIUM). EncFS before 1.7.0 encrypts multiple blocks by means of the CFB cipher mode with the same initialization vector, which makes it easier for local users to obtain sensitive information via calculations ...
How severe is CVE-2010-3075?
CVE-2010-3075 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-3075?
Check the references section above for vendor advisories and patch information. Affected products include: Arg0 Encfs.