USN-783-1

Executive Summary

Summary
Title	eCryptfs vulnerability

Informations
Name	USN-783-1	First vendor Publication	2009-06-08
Vendor	Ubuntu	Last vendor Modification	2009-06-08
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:P/I:N/A:N)
Cvss Base Score	1.9	Attack Range	Local
Cvss Impact Score	2.9	Attack Complexity	Medium
Cvss Expoit Score	3.4	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 9.04

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.04:
ecryptfs-utils 73-0ubuntu6.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Chris Jones discovered that the eCryptfs support utilities would
report the mount passphrase into installation logs when an eCryptfs
home directory was selected during Ubuntu installation. The logs are
only readable by the root user, but this still left the mount passphrase
unencrypted on disk, potentially leading to a loss of privacy.