GLSA 200603-15: Crypt::CBC: Insecure initialization vector

http://security.gentoo.org/

Severity:	low
Title:	Crypt::CBC: Insecure initialization vector
Date:	03/17/2006
Bugs:	#126048
ID:	200603-15

Synopsis

Crypt::CBC uses an insecure initialization vector, potentially resulting in a weaker encryption.

Background

Crypt::CBC is a Perl module to encrypt data using cipher block chaining (CBC).

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
dev-perl/crypt-cbc	< 2.17	>= 2.17	All supported architectures

Description

Lincoln Stein discovered that Crypt::CBC fails to handle 16 bytes long initializiation vectors correctly when running in the RandomIV mode, resulting in a weaker encryption because the second part of every block will always be encrypted with zeros if the blocksize of the cipher is greater than 8 bytes.

Impact

An attacker could exploit weak ciphertext produced by Crypt::CBC to bypass certain security restrictions or to gain access to sensitive data.

Workaround

There is no known workaround at this time.

Resolution

All Crypt::CBC users should upgrade to the latest available version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-perl/crypt-cbc-2.17"

References

CVE-2006-0898

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200603-15.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.