oss-security - Re: CVE Request -- EncFS / fuse-encfs [three ids] -- Multiple Vulnerabilities in EncFS

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 7 Sep 2010 15:05:38 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Valient Gough <vgough@...ox.com>, Micha Riser <micha@...world.org>,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- EncFS / fuse-encfs [three ids] --
 Multiple Vulnerabilities in EncFS

Here goes:

CVE-2010-3073 encfs Only 32 bit of file IV used
CVE-2010-3074 encfs Watermarking attack
CVE-2010-3075 encfs Last block with single byte is insecure"

Thanks

-- 
    JB


----- "Jan Lieskovsky" <jlieskov@...hat.com> wrote:

> Hello Steve, vendors,
> 
>    Micha Riser reported:
>    [A]
> http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html
> 
> three security flaws in EncFS encrypted filesystem (more from [A]):
> 
> "A security analysis of EncFS has revealed multiple vulnerabilities:
> (1) Only 32 bit of file IV used
> (2) Watermarking attack
> (3) Last block with single byte is insecure"
> 
> References:
>    [B] http://www.arg0.net/encfs
>    [C] http://bugs.gentoo.org/show_bug.cgi?id=335938
>    [D]
> http://archives.neohapsis.com/archives/fulldisclosure/2010-08/att-0316/watermark-attack-encfs.tar.gz
>    [E] https://bugzilla.redhat.com/show_bug.cgi?id=630460
> 
> 
> Solutions / patches information:
> ================================
> 
> * for issue (1) -- seems it wasn't fixed / isn't possible to
>    fix without breaking backward compatibility. More from [B]:
> 
>    "The old IV setup is kept for backwards compatibility."
> 
> * for issue (2) -- EncFS upstream has released a fix for the issue:
>    [F] http://code.google.com/p/encfs/source/detail?r=59
> 
> Valient, could you please confirm, the above referenced [F] patch,
> is the correct one to address the watermarking attack issue?
> 
> * for issue (3) -- not sure about patch status (included in [F] too?)
> 
> Steve, could you allocate CVE ids for these flaws?
> 
> Thanks && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.