CVE-2010-3074 SSL_Cipher.cpp in EncFS before 1.7.0 uses an improper combination of an AES cipher and a CBC cipher mode for encrypted filesystems, which allows local users to obtain sensitive information via a water...
LowCVSS 2.1
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SSL_Cipher.cpp in EncFS before 1.7.0 uses an improper combination of an AES cipher and a CBC cipher mode for encrypted filesystems, which allows local users to obtain sensitive information via a watermark attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arg0 encfs | <= 1.6.0 | No fix listed |
| arg0 encfs | = 1.4.0 | No fix listed |
| arg0 encfs | = 1.4.1 | No fix listed |
| arg0 encfs | = 1.4.1.1 | No fix listed |
| arg0 encfs | = 1.4.2 | No fix listed |
| arg0 encfs | = 1.5.0 | No fix listed |
| debian/encfs(Debian:12) | < 1.7.2-1 | 1.7.2-1 |
| debian/encfs(Debian:13) | < 1.7.2-1 | 1.7.2-1 |
References
- 20100826 Multiple Vulnerabilities in EncFS mailing-list
- bugs.gentoo.org
- code.google.com
- FEDORA-2010-14268 vendor-advisory
- FEDORA-2010-14254 vendor-advisory
- FEDORA-2010-14200 vendor-advisory
- SUSE-SR:2010:023 vendor-advisory
- 41158 third-party-advisory vendor-advisory
- 41478 third-party-advisory vendor-advisory
- www.arg0.net
- [oss-security] 20100905 CVE Request -- EncFS / fuse-encfs [three ids] -- Multiple Vulnerabilities in EncFS mailing-list
- [oss-security] 20100905 Re: CVE Request -- EncFS / fuse-encfs [three ids] -- Multiple Vulnerabilities in EncFS mailing-list
- [oss-security] 20100907 Re: CVE Request -- EncFS / fuse-encfs [three ids] -- Multiple Vulnerabilities in EncFS mailing-list
- ADV-2010-2414 vdb-entry vendor-advisory
- bugzilla.redhat.com
- Debian Security Tracker CVE-2010-3074 vendor-advisory
- bugs.debian.org issue-tracking