oss-security - CVE-2017-18021: predictably random password generation in third-party pass-compatible software, "QtPass"

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAHmME9or=myCkR3_iNfZ__k0tcYpPK5_FBpSqdR43p9p5qYEgA@mail.gmail.com>
Date: Fri, 5 Jan 2018 21:28:11 +0100
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: CVE-2017-18021: predictably random password generation in third-party
 pass-compatible software, "QtPass"

Hi folks,

"QtPass" is a separate project entirely from pass. It shares no code
with "pass", the project I maintain. But, "QtPass" does endeavor to be
compatible with pass. However, it is in fact a completely separate
project. Best practice is probably not to stray too far from my nest
to these third-party GUIs, given bugs like this one, CVE-2017-18021, a
way of trivially predicting all passwords ever generated with
"QtPass".

Bug report is here: https://github.com/IJHack/QtPass/issues/338
Fix landed in v1.2.1: https://github.com/IJHack/QtPass/releases/tag/v1.2.1

All passwords generated with "QtPass"'s built-in password generator
are possibly predictable and enumerable by hackers. The generator used
libc's random(), seeded with srand(msecs), where msecs is not the
msecs since 1970 (not that that'd be secure anyway), but rather the
msecs since the last second. This means there are only 1000 different
sequences of generated passwords. Disaster.

If you're using this software, now would be a good time to change all
your passwords and regenerate them using a secure utility such as pass
(what this mailing list is about), or update to the latest version of
this third party "QtPass" software and regenerate from there. All
distributions should update and remove vulnerable versions from their
package trees.

The fix I proposed to the "QtPass" developers involves using Qt 5.10's
built-in CSPRNG wrapper, or /dev/urandom for older Qt versions.

Regards,
Jason

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.