CVE-2013-7252: Medium severity KDE KDE Applications vulnerability
It was found that kwallet, a tool for managing the passwords on a KDE system, uses Blowfish to encrypt its password store, and despite an attempt at implementing CBC mode (in a file called cbc.cc no less), it's actually ECB mode. UTF-16 encoding combined with Blowfish's 64 bit block size means there are just four password characters per block. Encryption is convergent as well.
The risk is that this may enable recovery of passwords through codebook attacks.
References: http://seclists.org/oss-sec/2014/q1/2 http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/
Other sources
kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7252?
CVE-2013-7252 is considered a medium severity vulnerability due to its potential impact on confidentiality.
How do I fix CVE-2013-7252?
To mitigate CVE-2013-7252, update to a version of KDE Applications beyond 14.11.3 where the issue has been addressed.
What systems are affected by CVE-2013-7252?
CVE-2013-7252 affects KDE Applications versions up to and including 14.11.3.
What type of encryption is compromised in CVE-2013-7252?
CVE-2013-7252 is compromised due to the misuse of ECB mode in the encryption process instead of the intended CBC mode.
What is the main risk associated with CVE-2013-7252?
The main risk associated with CVE-2013-7252 is that it may allow unauthorized users to infer sensitive information from the encrypted password store.