oss-sec mailing list archives
Re: CVE request: python-pyrad insecurities
From: Vincent Danen <vdanen () redhat com>
Date: Fri, 15 Feb 2013 16:53:43 -0700
* [2013-02-15 19:51:07 +0000] Christey, Steven M. wrote:
These two issues were fixed in the same diff and reflect poor randomness - should we have only assigned one CVE? (If the RADIUS feature was introduced in different versions than the authenticator-password feature, then maybe the SPLIT is acceptable.)
I'm not sure. I didn't go digging to see when they were introduced -- both features may have been introduced at the same time (or not). Ok, so doing a quick peek at the first full blob of it in git: https://github.com/wichert/pyrad/blob/c206b1dfc362db8b0ef9c256814377bde8ed91cf/pyrad/packet.py The use of random.randrange() is in both the CreateAuthenticator() and CreateID() functions, so I would bet that they've been like that the whole time (that blob is from Sept 2007). So I guess one CVE is probably sufficient. I only noted them as two issues as we had two separate bug reports about them.
-----Original Message----- From: Kurt Seifried [mailto:kseifried () redhat com] Sent: Friday, February 15, 2013 2:37 PM To: oss-security () lists openwall com Cc: Vincent Danen Subject: Re: [oss-security] CVE request: python-pyrad insecurities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 02/15/2013 09:14 AM, Vincent Danen wrote:Could a CVE be assigned to the following two issues please? #1: https://bugzilla.redhat.com/show_bug.cgi?id=911682 Nathaniel McCallum of Red Hat reported that pyrad was using Python's random module in a number of places to generate pseudo-random data. In the case of the authenticator data, it was being used to secure a password sent over the wire. Because Python's random module is not really suited for this purpose (not random enough), it could lead to password hashing that may be predictable.Please use CVE-2013-0294 for this issue.#2: https://bugzilla.redhat.com/show_bug.cgi?id=911685 Nathaniel McCallum of Red Hat reported that pyrad was creating serialized RADIUS packet IDs in the CreateID() function in packet.py. This is not suitable for RADIUS as the RFC specifies that the ID must not be predictable. As a result, the ID of the next packet sent can be spoofed.Please use CVE-2013-0295 for this issue.These have been corrected in upstream's forthcoming version 2.1 via: https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5- -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJRHo5KAAoJEBYNRVNeJnmT32YP/RUrucNudALgorUcvGb12Btf Xtp5JPu+nYZDWq+i1au4ZMc1TZv12LKSErrvxaQZT04f6K6NvD74drqtHXf1a5ck NWAsk/RIRFrNmSvwkmL02352LWzKlPLfM7ZsiJgU73XEPmkLYdVCTopgGzKYaWYe vWKd7C3l1a/2b2I2C+O2OT2jyi89K3LQSzdZVSd7Mf81gDtDnkyQ8RT5QpcCPVRa XbfKdfzVdLNEw26n5k8/alpjvBARyv4KA7ZA4qQzaI9P32Nw1DFE/8zBbrHkrhj5 V83HyOtQyqrYryreNahGkBtLc1LQZ8b81pOvNaE2FRVgA7M5VA4JH4OaL8NCornJ ozicUuB/U32D24Ox7UqR+nkScPCBAhj/iVz+lkKac3WHLNGJGSa25WwWjoaWPrip YaFZHzyijIAdYsr7tHoxTncKNhqtCClyiX6RZdPKKAfDGFV4hPfktwOY8Di6u+hM B8ANPe+nDi7kB4BQcm5Qj7RJ7KY0eixxYgv4ynhvvmdDlpFJwGh8rIilmCCGdVMa GDYjVzgR/SXTFOYWZ9pWc90Ixa3wNtqiCHNwUqKmKldHZvyph0XS4K0HM/o0IQny 0aHSg04nSM9jlUOczlCwShhTrRHmTkkuRkXsVlv0ibtORTwcotD/9xghkLK9ktHb 3HiFhtqk0CvJBtNMFcRG =z9JH -----END PGP SIGNATURE-----
--Vincent Danen / Red Hat Security Response Team
Current thread:
- CVE request: python-pyrad insecurities Vincent Danen (Feb 15)
- Re: CVE request: python-pyrad insecurities Kurt Seifried (Feb 15)
- RE: CVE request: python-pyrad insecurities Christey, Steven M. (Feb 15)
- Re: CVE request: python-pyrad insecurities Vincent Danen (Feb 15)
- Re: CVE request: python-pyrad insecurities Kurt Seifried (Feb 15)
- Re: CVE request: python-pyrad insecurities Vincent Danen (Feb 21)
- Re: CVE request: python-pyrad insecurities Kurt Seifried (Feb 21)
- RE: CVE request: python-pyrad insecurities Christey, Steven M. (Feb 15)
- Re: CVE request: python-pyrad insecurities Kurt Seifried (Feb 15)