CVE-2010-3073
First published: Sun Sep 05 2010(Updated: )
SSL_Cipher.cpp in EncFS before 1.7.0 does not properly handle integer data sizes when constructing headers intended for randomization of initialization vectors, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arg0 Encfs | =1.4.0 | |
| Arg0 Encfs | <=1.6.0 | |
| Arg0 Encfs | =1.4.2 | |
| Arg0 Encfs | =1.4.1 | |
| Arg0 Encfs | =1.5.0 | |
| Arg0 Encfs | =1.4.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047798.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047794.html
- http://code.google.com/p/encfs/source/detail?r=59
- http://secunia.com/advisories/41478
- http://secunia.com/advisories/41158
- https://bugzilla.redhat.com/show_bug.cgi?id=630460
- http://www.vupen.com/english/advisories/2010/2414
- http://www.openwall.com/lists/oss-security/2010/09/07/8
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047825.html
- http://www.openwall.com/lists/oss-security/2010/09/05/3
- http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html
- http://www.openwall.com/lists/oss-security/2010/09/06/1
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
- http://www.arg0.net/encfs
- http://bugs.gentoo.org/show_bug.cgi?id=335938
- http://archives.neohapsis.com/archives/fulldisclosure/2010-08/att-0316/watermark-attack-encfs.tar.gz
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=443181
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=443181&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=443182
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=443182&action=edit
- https://access.redhat.com/security/cve/CVE-2010-3073
- https://access.redhat.com/security/cve/CVE-2010-3074
- https://access.redhat.com/security/cve/CVE-2010-3075
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=630460#c6
- collector/nvd-historical
- collector/redhat-bugzilla
- alias/CVE-2010-3073
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- vendor/arg0
- canonical/arg0 encfs
- version/arg0 encfs/1.4.0
- version/arg0 encfs/1.6.0
- version/arg0 encfs/1.4.2
- version/arg0 encfs/1.4.1
- version/arg0 encfs/1.5.0
- version/arg0 encfs/1.4.1.1