Home page logo

oss-sec logo oss-sec mailing list archives

CVE Request: reseed
From: Jamie Strandboge <jamie () canonical com>
Date: Wed, 06 Jul 2011 08:04:36 -0500

On Wed, 2011-07-06 at 07:47 -0500, Jamie Strandboge wrote:
A security bug was reported by Jeffrey Walton against reseed in
Ubuntu. You are being emailed as the upstream contact. Please keep
oss-security () lists openwall com[1] CC'd for any updates on this issue.

This issue should be considered public. A CVE is being requested; please
mention this in any changelogs.

Details from the public bug follow:

From the reporter:
"reseed(8) performs an insecure HTTP fetch of data from random.org. The
script is automatically executed when installed, and any time the user
chooses to execute. In addition, the reseed man pages do not mention the
data is retrieved over an insecure channel."

As pointed out by the reporter, from the man page: "It is run once
during the installation of the package only". An attacker could perform
a MITM during package installation or whenever the reseed command is run
to provide predictable data for the random number seed.

While the attack is difficult to achieve (need both MITM at time of
package installation AIUI), it seems that this still should get a CVE.


Jamie Strandboge             | http://www.canonical.com

Attachment: signature.asc
Description: This is a digitally signed message part

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]