Re: A number of EncFS issues

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> https://defuse.ca/audits/encfs.htm
> the last one sounds CVE worthy

Use CVE-2014-3462 for that issue, i.e., 'The purpose of MAC headers is
to prevent an attacker with read/write access to the ciphertext from
being able to make changes without being detected. Unfortunately, this
feature provides little security, since it is controlled by an option
in the .encfs6.xml configuration file (part of the ciphertext), so the
attacker can just disable it by setting "blockMACBytes" to 0 and
adding 8 to "blockMACRandBytes" (so that the MAC is not interpreted as
data).'

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTcwbzAAoJEKllVAevmvms59MIALliH0nQBEhTa971v2fghjQS
XW43V8j42cD4i2yR91GfhJMCilyrRlxY1IQS7isleOQNBufmUavOs4gZmq1A+EGv
YD7F7MrQjLOKGLyl1aGbr5YpNmbYJONgqDnnpDdramjKo1MZKr/qexOLn51lLJQJ
J1RUaZIm+tccToBmkyhHS6rmHF/kutlvXt1goHKPkWaBWIdCz8zkPZWASj1D4KYX
Ynxtc+ikC60AdhQp1ggTmWff0NDnfjI7DUDWM88DbfLfGJ48/uAatgcEhKns326l
Z4eomykAB4IA62fgm0XisPrXNpibQs2aEOfr3fDwyCRBi7IA5y7C2SCFZ9V37bM=
=Rfv2
-----END PGP SIGNATURE-----