CVE-2007-3528 Weak cryptography in n/a
Weak Blowfish-CBC implementation in DAR allows attackers to decrypt files due to predictable IVs and direct password keying.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-3528?
CVE-2007-3528 is a medium-severity vulnerability in n/a, published on 3 Jul 2007.
Official description
The blowfish mode in DAR before 2.3.4 uses weak Blowfish-CBC cryptography by (1) discarding random bits by the blowfish::make_ivec function in libdar/crypto.cpp that results in predictable and repeating IV values, and (2) direct use of a password for keying, which makes it easier for context-dependent attackers to decrypt files.
Which versions are affected by CVE-2007-3528?
It affects 1 product.
Products include Dar Dar.
How do I fix CVE-2007-3528?
Upgrade to a fixed version.
Is CVE-2007-3528 being exploited?
There is no known exploitation of CVE-2007-3528 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2007-3528, GHSA-fw5v-h2w7-75mc.