oss-sec mailing list archives
Re: CVE Request: pwgen
From: Michael Samuel <mik () miknet net>
Date: Tue, 28 May 2013 01:33:48 +0000 (UTC)
Hi, I was the person who reported this via launchpad. The fallback could possibly be triggered accidentally by MAC schemes, such as selinux and apparmor. There's 8 packages in Ubuntu that depend on this, so I guess it would be worth checking them to see if they execute pwgen in an apparmor context that doesn't allow /dev/urandom access. I had a quick look at maas-region- controller, and it seems to just be calling it from a postinst script. I have a patch attached to the LP bug that removes the fallback (in favour of bailing out with an message to stderr and exit code 1), and removes the modulo bias. The default mode of this program generates extremely low entropy passwords - It is probably worth changing the default to "secure" mode and removing phonemes mode, to avoid putting users at risk. Regards, Michael
Current thread:
- CVE Request: pwgen Seth Arnold (May 24)
- Re: CVE Request: pwgen Kurt Seifried (May 24)
- Re: CVE Request: pwgen Michael Samuel (May 27)
- Re: CVE Request: pwgen Solar Designer (May 27)
- Re: CVE Request: pwgen Michael Samuel (Jun 05)
- Re: CVE Request: pwgen Michael Samuel (May 27)
- Re: CVE Request: pwgen Kurt Seifried (May 24)