[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 14 May 2014 02:12:49 -0400 (EDT)
From: cve-assign@...re.org
To: mmcallis@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com,
736066@...s.debian.org
Subject: Re: A number of EncFS issues
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://defuse.ca/audits/encfs.htm
> the last one sounds CVE worthy
Use CVE-2014-3462 for that issue, i.e., 'The purpose of MAC headers is
to prevent an attacker with read/write access to the ciphertext from
being able to make changes without being detected. Unfortunately, this
feature provides little security, since it is controlled by an option
in the .encfs6.xml configuration file (part of the ciphertext), so the
attacker can just disable it by setting "blockMACBytes" to 0 and
adding 8 to "blockMACRandBytes" (so that the MAC is not interpreted as
data).'
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTcwbzAAoJEKllVAevmvms59MIALliH0nQBEhTa971v2fghjQS
XW43V8j42cD4i2yR91GfhJMCilyrRlxY1IQS7isleOQNBufmUavOs4gZmq1A+EGv
YD7F7MrQjLOKGLyl1aGbr5YpNmbYJONgqDnnpDdramjKo1MZKr/qexOLn51lLJQJ
J1RUaZIm+tccToBmkyhHS6rmHF/kutlvXt1goHKPkWaBWIdCz8zkPZWASj1D4KYX
Ynxtc+ikC60AdhQp1ggTmWff0NDnfjI7DUDWM88DbfLfGJ48/uAatgcEhKns326l
Z4eomykAB4IA62fgm0XisPrXNpibQs2aEOfr3fDwyCRBi7IA5y7C2SCFZ9V37bM=
=Rfv2
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
