FreeBSD : kde-runtime -- incorrect CBC encryption handling (7a8a74d1-9c34-11e4-a40b-5453ed2e2b49)

Medium Nessus Plugin ID 80537


The remote FreeBSD host is missing a security-related update.


Valentin Rusu reports :

Until KDE Applications 14.12.0, kwalletd incorrectly handled CBC encryption blocks when encrypting secrets in kwl files. The secrets were still encrypted, but the result binary data corresponded to an ECB encrypted block instead of CBC.

The ECB encryption algorithm, even if it'll scramble user data, will produce same encrypted byte sequence for the same input text. As a result, attackers may eventually find-out the encrypted text.


Update the affected package.

See Also

Plugin Details

Severity: Medium

ID: 80537

File Name: freebsd_pkg_7a8a74d19c3411e4a40b5453ed2e2b49.nasl

Version: $Revision: 1.2 $

Type: local

Published: 2015/01/15

Modified: 2015/01/22

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:kde-runtime, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2015/01/14

Vulnerability Publication Date: 2015/01/09

Reference Information

CVE: CVE-2013-7252