Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Gentoo: GLSA-202310-12 Moderate: KWalletd Privilege Escalation

gentoo
Calendar Grey June 28, 2016
Dist Gentoo Esm H88
Kwalletd encryption flaws in Gentoo pose significant risks of data breaches through codebook attacks, necessitating an immediate software update to safeguard users.
Kwalletd password stores are vulnerable to codebook attacks.

Summary

Kwalletd in KWallet uses Blowfish with ECB mode instead of CBC mode when encrypting the password store.

Topics%20covered

Topics Covered

security advisory gentoo information disclosure password management codebook attack

Resolution

All kwalletd users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=kde-apps/kwalletd-4.14.3-r1"

References

[ 1 ] CVE-2013-7252 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7252

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201606-19
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: kwalletd: Information disclosure
Date: June 27, 2016
Bugs: #496768
ID: 201606-19

Topics%20covered

Topics Covered

security advisory gentoo information disclosure password management codebook attack

Synopsis

Kwalletd password stores are vulnerable to codebook attacks.

Background

Kwalletd is is a credentials management application for KDE.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 kde-apps/kwalletd < 4.14.3-r2 >= 4.14.3-r2

Impact

===== Local attackers, with access to the password store, could conduct a codebook attack in order to obtain confidential passwords.

Workaround

There is no known workaround at this time.

Your message here