CVE-2013-7252

Published: Jan 18, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack.

Affected (1)

Products: Kde: Kde Applications

Kde

1 product

Kde Applications

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Kde Kde Applications	Up to 14.11.3

Related CWEs

CWE-310

References (14)

http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/

Source: secalert@redhat.com

Exploit

http://www.openwall.com/lists/oss-security/2014/01/02/3

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2015/01/09/7

Source: secalert@redhat.com

http://www.securityfocus.com/bid/67716

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1048168

Source: secalert@redhat.com

Issue Tracking

https://security.gentoo.org/glsa/201606-19

Source: secalert@redhat.com

Third Party Advisory

https://www.kde.org/info/security/advisory-20150109-1.txt

Source: secalert@redhat.com

PatchVendor Advisory

http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/