Bugtraq mailing list archives
Re: RSI.0012.12-03-98.SOLARIS.MKCOOKIE
From: chris () CYBERNET CO NZ (Chris Wedgwood)
Date: Fri, 11 Dec 1998 16:00:50 +1300
On Mon, Dec 07, 1998 at 01:39:05PM -0500, Readwin, Neil wrote:
On Solaris mkcookie opens /dev/mem and reads about 8MB of it. mkcookie will run and generate a new cookie if you remove the suid bit, but I guess said cookie will be, umm, less random.
This reminds me (I may have reported this eons ago, I forget). An old version of util-linux (some years old) also has a hosed mcookie program. You can test this by doing something like; while [ 1 ] ; do mcookie >> file ; done <pause a few minutes> ^C sort file | uniq | wc Basically... I was never able to get more that 16384 (2^14) unique tokens, a pretty small space compared to the theoretical 2^128. <Insert usual bit about birthday attack, blah blah blah> I don't know which version of util-linux it was, but I'm pretty sure 2.5 and above use /dev/random and hence don't have this behaviour. -Chris
Current thread:
- RSI.0012.12-03-98.SOLARIS.MKCOOKIE RSI Advise (Dec 03)
- Re: RSI.0012.12-03-98.SOLARIS.MKCOOKIE Pavel Kankovsky (Dec 04)
- <Possible follow-ups>
- Re: RSI.0012.12-03-98.SOLARIS.MKCOOKIE Readwin, Neil (Dec 07)
- Exploitable buffer overflow in bootpd (most unices) Willem Pinckaers (Jun 24)
- Re: Exploitable buffer overflow in bootpd (most unices) Chris Evans (Dec 13)
- Triteal release updated CDE with security fixes Alan Cox (Dec 13)
- Wietse's Postfix (was VMailer) software release Wietse Venema (Dec 13)
- Re: RSI.0012.12-03-98.SOLARIS.MKCOOKIE Chris Wedgwood (Dec 10)
- FW: ISSalert: ISS Security Advisory: HP JetDirect TCP/IP problems Phear Me (Dec 11)
- Pine 4.05 patches GvS (Dec 12)
- Microsoft's Network Monitor - Buffer Overrun / Page Fault / mnemonix (Dec 12)
- Exploitable buffer overflow in bootpd (most unices) Willem Pinckaers (Jun 24)