CVE-2010-3073
First published: Sun Sep 05 2010(Updated: )
Micha Riser reported: [A] <a href="http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html">http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html</a> three security flaws in EncFS encrypted filesystem (more from [A]): A security analysis of EncFS has revealed multiple vulnerabilities: (1) Only 32 bit of file IV used (2) Watermarking attack (3) Last block with single byte is insecure References: [B] <a href="http://www.arg0.net/encfs">http://www.arg0.net/encfs</a> [C] <a href="http://bugs.gentoo.org/show_bug.cgi?id=335938">http://bugs.gentoo.org/show_bug.cgi?id=335938</a> [D] <a href="http://archives.neohapsis.com/archives/fulldisclosure/2010-08/att-0316/watermark-attack-encfs.tar.gz">http://archives.neohapsis.com/archives/fulldisclosure/2010-08/att-0316/watermark-attack-encfs.tar.gz</a> Solutions / patches information: ================================ * for issue (1) -- seems it wasn't fixed / isn't possible to fix without breaking backward compatibility. More from [B]: "The old IV setup is kept for backwards compatibility." * for issue (2) -- EncFS upstream has released a fix for the issue: [E] <a href="http://code.google.com/p/encfs/source/detail?r=59">http://code.google.com/p/encfs/source/detail?r=59</a> Asked Valient to confirm yet, [E] is the proper patch for issue (2) / the watermarking attack /. * for issue (3) -- not sure about patch status. CVE Request: [F] <a href="http://www.openwall.com/lists/oss-security/2010/09/05/3">http://www.openwall.com/lists/oss-security/2010/09/05/3</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Encfs | =1.4.0 | |
| Encfs | <=1.6.0 | |
| Encfs | =1.4.2 | |
| Encfs | =1.4.1 | |
| Encfs | =1.5.0 | |
| Encfs | =1.4.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047798.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047794.html
- http://code.google.com/p/encfs/source/detail?r=59
- http://secunia.com/advisories/41478
- http://secunia.com/advisories/41158
- https://bugzilla.redhat.com/show_bug.cgi?id=630460
- http://www.vupen.com/english/advisories/2010/2414
- http://www.openwall.com/lists/oss-security/2010/09/07/8
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047825.html
- http://www.openwall.com/lists/oss-security/2010/09/05/3
- http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html
- http://www.openwall.com/lists/oss-security/2010/09/06/1
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
- http://www.arg0.net/encfs
- http://bugs.gentoo.org/show_bug.cgi?id=335938
- http://archives.neohapsis.com/archives/fulldisclosure/2010-08/att-0316/watermark-attack-encfs.tar.gz
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=443181
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=443181&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=443182
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=443182&action=edit
- https://access.redhat.com/security/cve/CVE-2010-3073
- https://access.redhat.com/security/cve/CVE-2010-3074
- https://access.redhat.com/security/cve/CVE-2010-3075
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=630460#c6
Frequently Asked Questions
What is the severity of CVE-2010-3073?
CVE-2010-3073 is rated as a high severity vulnerability affecting the EncFS encrypted filesystem.
How do I fix CVE-2010-3073?
To fix CVE-2010-3073, upgrade your EncFS to version 1.6.0 or later.
What versions of EncFS are affected by CVE-2010-3073?
CVE-2010-3073 affects EncFS versions 1.4.0 through 1.6.0, including specific versions like 1.4.1 and 1.5.0.
What type of vulnerability is CVE-2010-3073?
CVE-2010-3073 includes multiple security flaws identified through a security analysis of EncFS.
Who reported CVE-2010-3073?
CVE-2010-3073 was reported by Micha Riser.
- collector/redhat-bugzilla
- alias/CVE-2010-3073
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- agent/event
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/arg0
- canonical/encfs
- version/encfs/1.4.0
- version/encfs/1.6.0
- version/encfs/1.4.2
- version/encfs/1.4.1
- version/encfs/1.5.0
- version/encfs/1.4.1.1