CVE-2007-3528 — Generation of Weak Initialization Vector in DAR
Severity
5.0MEDIUMNVD
EPSS
0.5%
top 32.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 3
Latest updateMay 1
Description
The blowfish mode in DAR before 2.3.4 uses weak Blowfish-CBC cryptography by (1) discarding random bits by the blowfish::make_ivec function in libdar/crypto.cpp that results in predictable and repeating IV values, and (2) direct use of a password for keying, which makes it easier for context-dependent attackers to decrypt files.
CVSS vector
AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9
Affected Packages3 packages
Patches
🔴Vulnerability Details
2📋Vendor Advisories
1Debian▶
CVE-2007-3528: dar - The blowfish mode in DAR before 2.3.4 uses weak Blowfish-CBC cryptography by (1)...↗2007