[转载]Crypt ECB Block Zero Truncation

信息来源：www.securiteam.com

Summary
There is a bug in the Crypt::ECB module that affects the way it processes blocks of data. It appears that Crypt::ECB incorrectly processes the last block of data if it contains a single ASCII "0". This has been tested using the Blowfish, Rijndael, TripleDES, DES, and IDEA algorithms. Below is some proof-of-concept code to demonstrate the problem. The problem is produced where the plain-text data length is one more than ((n % 8) == 0).

Details
Proof of Concept:
#!/usr/local/bin/perl

use Crypt::ECB;

my $cipher = "Blowfish";
my $key = "pb25YTt7d5b55711fd50bffcec4058d3e6c86bfc4c796bec2249b447";
my $plain = "12345678123456780";

my $crypt = Crypt::ECB->new;

$crypt->padding(PADDING_AUTO);
$crypt->cipher($cipher) or die $crypt->errstring;
$crypt->key($key);

printf "Plain = '%s'\n", $plain;

my $enc = $crypt->encrypt_hex($plain);
printf "Encrypted = '%s'\n", $enc;

my $dec = $crypt->decrypt_hex($enc);
printf "Decrypted = '%s'\n", $dec;

Patch:
###
### Diff for ECB fix (output from diff -u)
###
### Test Data:
### Plain: ILlW1nr30
### Key: pb25YTt7d5b55711fd50bffcec4058d3e6c86bfc4c796bec2249b447
### Pad: AUTO
###
--- ECB.pm 2000-12-23 13:16:38.000000000 -0500
+++ ECB2.pm 2004-12-06 12:45:23.000000000 -0500
@@ -1,4 +1,4 @@
-package Crypt::ECB;
+package Crypt::ECB2;

# Copyright (C) 2000 Christoph Appel, cappel@debis.com
# see documentation for details
@@ -274,7 +274,7 @@
$crypt->{Mode} = '';
$crypt->{buffer} = '';

- return '' unless $data;
+ return '' unless length($data) > 0;

my $cipher = $crypt->_getcipher;

Additional information
The information has been provided by Bennett R. Samowich.