oss-security - CVE Request -- EncFS / fuse-encfs [three ids] -- Multiple Vulnerabilities in EncFS

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 05 Sep 2010 20:33:10 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security <oss-security@...ts.openwall.com>,
        Valient Gough <vgough@...ox.com>, Micha Riser <micha@...world.org>
Subject: CVE Request -- EncFS / fuse-encfs [three ids] -- Multiple Vulnerabilities
 in EncFS

Hello Steve, vendors,

   Micha Riser reported:
   [A] http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html

three security flaws in EncFS encrypted filesystem (more from [A]):

"A security analysis of EncFS has revealed multiple vulnerabilities:
(1) Only 32 bit of file IV used
(2) Watermarking attack
(3) Last block with single byte is insecure"

References:
   [B] http://www.arg0.net/encfs
   [C] http://bugs.gentoo.org/show_bug.cgi?id=335938
   [D] http://archives.neohapsis.com/archives/fulldisclosure/2010-08/att-0316/watermark-attack-encfs.tar.gz
   [E] https://bugzilla.redhat.com/show_bug.cgi?id=630460


Solutions / patches information:
================================

* for issue (1) -- seems it wasn't fixed / isn't possible to
   fix without breaking backward compatibility. More from [B]:

   "The old IV setup is kept for backwards compatibility."

* for issue (2) -- EncFS upstream has released a fix for the issue:
   [F] http://code.google.com/p/encfs/source/detail?r=59

Valient, could you please confirm, the above referenced [F] patch,
is the correct one to address the watermarking attack issue?

* for issue (3) -- not sure about patch status (included in [F] too?)

Steve, could you allocate CVE ids for these flaws?

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.