RedhatCVELIST:CVE-2010-3073CVE-2010-3073
SSL_Cipher.cpp in EncFS before 1.7.0 does not properly handle integer data sizes when constructing headers intended for randomization of initialization vectors, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms.
References
archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html
code.google.com/p/encfs/source/detail?r=59
lists.fedoraproject.org/pipermail/package-announce/2010-September/047794.html
lists.fedoraproject.org/pipermail/package-announce/2010-September/047798.html
lists.fedoraproject.org/pipermail/package-announce/2010-September/047825.html
lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
secunia.com/advisories/41158
secunia.com/advisories/41478
www.openwall.com/lists/oss-security/2010/09/05/3
www.openwall.com/lists/oss-security/2010/09/06/1
www.openwall.com/lists/oss-security/2010/09/07/8
www.vupen.com/english/advisories/2010/2414
bugzilla.redhat.com/show_bug.cgi?id=630460
Related
