oss-sec mailing list archives
Re: CVE request: crypt_blowfish 8-bit character mishandling
From: Ludwig Nussel <ludwig.nussel () suse de>
Date: Wed, 13 Jul 2011 13:37:30 +0200
Solar Designer wrote:
On Mon, Jul 11, 2011 at 04:39:08PM +0200, Ludwig Nussel wrote: [...]Keep using the buggy algorithm for new passwords and keep storing them as 2aI'd be unhappy about that, but it's a valid option to provide if you want to minimize user annoyance, including for networked systems that are not upgraded in sync (but are manually configured for this...)
After more thinking however ... adding any option that influences how new passwords are generated means we have to patch all applications that generate passwords to honor that option, ie parse the config file. On OpenSUSE I've found pam_unix2, pwdutils, mkpasswd and yast2 so far. Biting the bullet and just hardcoding 2y would be much easier. Nevertheless if we miss to patch any package there would be still the chance of someone generating 2a hashes with a different algorithm than what the system uses to verify them later though. So implementing your original idea and have crypt_gensalt change the prefix wouldn't be that bad after all. That bears the risk to break some programs like mkpasswd but they would at least fail with an error rather than generating unusable hashes. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Current thread:
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 06)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Ludwig Nussel (Jul 07)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 07)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 08)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 07)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 07)
- <Possible follow-ups>
- Re: CVE request: crypt_blowfish 8-bit character mishandling Ludwig Nussel (Jul 07)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 07)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Ludwig Nussel (Jul 11)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 11)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Ludwig Nussel (Jul 12)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Ludwig Nussel (Jul 13)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 14)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Ludwig Nussel (Jul 14)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 14)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 17)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 17)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Aug 03)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Solar Designer (Jul 07)
- Re: CVE request: crypt_blowfish 8-bit character mishandling Ludwig Nussel (Jul 07)