oss-sec mailing list archives
CVE Request: pwgen
From: Seth Arnold <seth.arnold () canonical com>
Date: Fri, 24 May 2013 14:43:29 -0700
Hello Kurt, Steve, all, Do these issues deserve CVE numbers? A user reported to launchpad [1] that pwgen will use /dev/urandom or /dev/random if it can, but will silently fall back to using drand48() or random() if the device files fail to open. The report also mentions that when the device files are available, the output is biased by too-simple use of the modulo operator to scale the output to 0 <= n < max. There are further complaints about the poor use of available entropy when seeding the weaker algorithms. A potentially related complaint is in Debian's BTS [2]: in this bug report, the user wanted a way to force use of /dev/random even if /dev/urandom is available. I've pasted the relevant source to pastebin.ubuntu.com [3]. Are any of these worthy of a CVE number? - silent fall-back to weak algorithms - biased output due to poor use of modulo operations - poor seeding of weak algorithms Thank you 1: https://bugs.launchpad.net/ubuntu/+source/pwgen/+bug/1183213 2: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=672241 3: http://pastebin.ubuntu.com/5698361/
Attachment:
signature.asc
Description: Digital signature
Current thread:
- CVE Request: pwgen Seth Arnold (May 24)
- Re: CVE Request: pwgen Kurt Seifried (May 24)
- Re: CVE Request: pwgen Michael Samuel (May 27)
- Re: CVE Request: pwgen Solar Designer (May 27)
- Re: CVE Request: pwgen Michael Samuel (Jun 05)
- Re: CVE Request: pwgen Michael Samuel (May 27)
- Re: CVE Request: pwgen Kurt Seifried (May 24)