PowerArchiver Insecure PKZIP Encryption

2014.03.14
Credit: Hanno B
Risk: Medium
Local: Yes
Remote: No
CWE: CWE-310


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

PowerArchiver: Uses insecure legacy PKZIP encryption when AES is selected (CVE-2014-2319) References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2319 http://int21.de/cve/CVE-2014-2319-powerarchiver.html http://www.powerarchiver.com/2014/03/12/powerarchiver-2013-14-02-05-released/ Background ftp://utopia.hacktic.nl/pub/crypto/cracking/pkzip.ps.gz Description The compression tool PowerArchiver version 14.02.03 creates files with an insecure encryption method even if the user selects a (secure) AES encryption in the GUI. If a user clicks on the "Encrypt Files" and selects "AES 256-bit" for encryption, the outcoming file will not be AES-encrypted. It will instead use the legacy PKZIP encryption, which uses a broken encryption algorithm. Note that there are different ways in PowerArchiver to create an encrypted ZIP file, the issue only appears when using the "Encrypt Files"-Button. The PKZIP encryption has been broken by Biham/Kocher in 1994. The vendor ConeXware has released version 14.02.05 which fixes the issue. It also disables completely support for creating archives with the broken legacy ZIP encryption. Disclosure Timeline 2014-03-10: Issue found, vendor contacted 2014-03-10: Vendor replies, confirms issue 2014-03-12: Vendor publishes fixed version -- Hanno Bck http://hboeck.de/ mail/jabber: hanno@hboeck.de GPG: BBB51E42


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top