Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request: crypt_blowfish 8-bit character mishandling
From: Ludwig Nussel <ludwig.nussel () suse de>
Date: Wed, 13 Jul 2011 13:37:30 +0200

Solar Designer wrote:
On Mon, Jul 11, 2011 at 04:39:08PM +0200, Ludwig Nussel wrote:
Keep using the buggy
algorithm for new passwords and keep storing them as 2a

I'd be unhappy about that, but it's a valid option to provide if you
want to minimize user annoyance, including for networked systems that
are not upgraded in sync (but are manually configured for this...)

After more thinking however ... adding any option that influences
how new passwords are generated means we have to patch all
applications that generate passwords to honor that option, ie parse
the config file. On OpenSUSE I've found pam_unix2, pwdutils,
mkpasswd and yast2 so far. Biting the bullet and just hardcoding 2y
would be much easier.

Nevertheless if we miss to patch any package there would be still the
chance of someone generating 2a hashes with a different algorithm than
what the system uses to verify them later though. So implementing your
original idea and have crypt_gensalt change the prefix wouldn't be
that bad after all. That bears the risk to break some programs like
mkpasswd but they would at least fail with an error rather than
generating unusable hashes.


 (o_   Ludwig Nussel
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imend├Ârffer, HRB 16746 (AG N├╝rnberg)

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]