Date: Sun, 05 Sep 2010 20:33:10 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security <oss-security@...ts.openwall.com>, Valient Gough <vgough@...ox.com>, Micha Riser <micha@...world.org> Subject: CVE Request -- EncFS / fuse-encfs [three ids] -- Multiple Vulnerabilities in EncFS Hello Steve, vendors, Micha Riser reported: [A] http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html three security flaws in EncFS encrypted filesystem (more from [A]): "A security analysis of EncFS has revealed multiple vulnerabilities: (1) Only 32 bit of file IV used (2) Watermarking attack (3) Last block with single byte is insecure" References: [B] http://www.arg0.net/encfs [C] http://bugs.gentoo.org/show_bug.cgi?id=335938 [D] http://archives.neohapsis.com/archives/fulldisclosure/2010-08/att-0316/watermark-attack-encfs.tar.gz [E] https://bugzilla.redhat.com/show_bug.cgi?id=630460 Solutions / patches information: ================================ * for issue (1) -- seems it wasn't fixed / isn't possible to fix without breaking backward compatibility. More from [B]: "The old IV setup is kept for backwards compatibility." * for issue (2) -- EncFS upstream has released a fix for the issue: [F] http://code.google.com/p/encfs/source/detail?r=59 Valient, could you please confirm, the above referenced [F] patch, is the correct one to address the watermarking attack issue? * for issue (3) -- not sure about patch status (included in [F] too?) Steve, could you allocate CVE ids for these flaws? Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.