Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <loom.20130528T031311-502@post.gmane.org>
Date: Tue, 28 May 2013 01:33:48 +0000 (UTC)
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: pwgen

Hi,

I was the person who reported this via launchpad.

The fallback could possibly be triggered accidentally by MAC schemes, such 
as selinux and apparmor.

There's 8 packages in Ubuntu that depend on this, so I guess it would be 
worth checking them to see if they execute pwgen in an apparmor context that 
doesn't allow /dev/urandom access.  I had a quick look at maas-region-
controller, and it seems to just be calling it from a postinst script.

I have a patch attached to the LP bug that removes the fallback (in favour 
of bailing out with an message to stderr and exit code 1), and removes the 
modulo bias.

The default mode of this program generates extremely low entropy passwords - 
It is probably worth changing the default to "secure" mode and removing 
phonemes mode, to avoid putting users at risk.

Regards,
  Michael

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.