radicale: CVE-2017-8342: htpasswd authentication vulnerable to timing-based bruteforce attacks

Debian Bug report logs - #861514
radicale: CVE-2017-8342: htpasswd authentication vulnerable to timing-based bruteforce attacks

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jonas Smedegaard <dr@jones.dk>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: radicale: htpasswd authentication vulnerable to timing-based bruteforce attacks

Date: Sun, 30 Apr 2017 00:40:27 +0200

Package: radicale
Version: 2.0.0~rc1-1
Severity: grave
Tags: security patch
Justification: user security hole

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Upstream has issued a security release:

> Add a random timer to avoid timing oracles and simple bruteforce
> attacks when using the htpasswd authentication method.

Actual patch:

commit 190b1dd795f0c552a4992445a231da760211183b
Author: Guillaume Ayoub <guillaume.ayoub@kozea.fr>
Date:   Wed Apr 19 14:02:51 2017 +0200

    Random timer to avoid timing oracles and simple bruteforce attacks
    
    Important note: this is a security fix.

diff --git a/radicale/auth/htpasswd.py b/radicale/auth/htpasswd.py
index 2c73f23..7cd7342 100644
- --- a/radicale/auth/htpasswd.py
+++ b/radicale/auth/htpasswd.py
@@ -56,7 +56,8 @@ following significantly more secure schemes are parsable by Radicale:
 import base64
 import hashlib
 import os
- -
+import random
+import time
 
 from .. import config
 
@@ -161,7 +162,10 @@ def is_authenticated(user, password):
             if strippedline:
                 login, hash_value = strippedline.split(":")
                 if login == user:
- -                    # Allow encryption method to be overridden at runtime.
- -                    return _verifuncs[ENCRYPTION](hash_value, password)
+                    if _verifuncs[ENCRYPTION](hash_value, password):
+                        # Allow encryption method to be overridden at runtime.
+                        return True
+    # Random timer to avoid timing oracles and simple bruteforce attacks
+    time.sleep(1 + random.random())
     return False
 


 - Jonas

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAlkFFlgACgkQLHwxRsGg
ASGQqQ//R1opffxilx3a60NOJffpD/2LCp0jecAd2hVeeTIwI8BcwEg4nY8jpCXo
6z7Y2ay758etRyJ54Jwga53PKqijHFrtLhL+oUyPebtMfWqtoR5cZhTvD9IC4GFP
bqK4ZVsop9lyvjD9+TdGAAL3/4FsQnYJctYvbWoTcSr+BcAvgmSgarxGiCr/jw2Z
iCMSi/0bcBoG4j19BrrAydP/l06yC5t8Mee3UmpswTNL3bTVqXN/zT81koy9m08a
1R9bKcggwQCQNtYXXtKkS545NuXdePpAoCo4ss67GjgwQoEua+GIMbR0KOLsGQoy
Fg7Nlc/a/UzZLy1OZgLSOV6Y5QvJHcNJY1hTGiKihgLI4uUso+wJbTMvrJhxlrQ3
IgzgKFqnySwLkxkXlA12pJK5pQL3kfxwXwf9otgOfsXcod9eMwuweLC088y3KXxN
ooNSxiJsFPoUU1C4oNczA/W+/O0EIZcYu4E9H9F9pR1SC3/YXylPySOUo6kVTRzf
Ggi+gSJE6pg5QmKLUqTV44RARSwaUbH8jVaS1SPZWIa+fzzbcIZmBF3ZKfA17ddk
k1bHHkVDtsQs7vn7l4ahQHR0izkciU8VkkUL3AFvtIv8PvhJtxpWihc8ewLVfoyC
Aej4omZuxTT3kXbO4aAkzeuKnsyTa20CRHNE6MHQUCVEHw6cN4U=
=HguT
-----END PGP SIGNATURE-----

Message #12 received at 861514@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Jonas Smedegaard <dr@jones.dk>, 861514@bugs.debian.org

Subject: Re: Bug#861514: radicale: htpasswd authentication vulnerable to timing-based bruteforce attacks

Date: Sun, 30 Apr 2017 07:29:42 +0200

Hi Jonas,

On Sun, Apr 30, 2017 at 12:40:27AM +0200, Jonas Smedegaard wrote:
> Package: radicale
> Version: 2.0.0~rc1-1

Quickly checked and at least the version in stretch is affected as
well (not done triage on older versions yet). There is a fix for the
1.1.x branch at:

https://github.com/Kozea/Radicale/commit/190b1dd795f0c552a4992445a231da760211183b

FTR, I have requested a CVE for this issue via https://cveform.mitre.org

Regards,
Salvatore

Message #19 received at 861514-close@bugs.debian.org (full text, mbox, reply):

From: Jonas Smedegaard <dr@jones.dk>

To: 861514-close@bugs.debian.org

Subject: Bug#861514: fixed in radicale 1.1.1+20160115-4

Date: Sun, 30 Apr 2017 07:48:48 +0000

Source: radicale
Source-Version: 1.1.1+20160115-4

We believe that the bug you reported is fixed in the latest version of
radicale, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 861514@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jonas Smedegaard <dr@jones.dk> (supplier of updated radicale package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 30 Apr 2017 09:14:16 +0200
Source: radicale
Binary: radicale python-radicale python3-radicale
Architecture: source
Version: 1.1.1+20160115-4
Distribution: unstable
Urgency: high
Maintainer: Jonas Smedegaard <dr@jones.dk>
Changed-By: Jonas Smedegaard <dr@jones.dk>
Description:
 python-radicale - simple calendar and addressbook server - python2 module
 python3-radicale - simple calendar and addressbook server - python3 module
 radicale   - simple calendar and addressbook server - daemon
Closes: 861514
Changes:
 radicale (1.1.1+20160115-4) unstable; urgency=high
 .
   * Add patch cherry-picked upstream to fix Python3 compatibility of
     ssha part of htpasswd.
   * Add patch cherry-picked upstream to fix security bug: Add delay in
     htpasswd authentication.
     Closes: Bug#861514.
Checksums-Sha1:
 1f0632d8a95f71ddc4d76aeee1f2d4561ac8e758 2304 radicale_1.1.1+20160115-4.dsc
 3010489685a259cc8c6011157e45be6f31f48cf3 24936 radicale_1.1.1+20160115-4.debian.tar.xz
 4c5d5716622322ebb7a06159c2797cc9461436a4 8469 radicale_1.1.1+20160115-4_amd64.buildinfo
Checksums-Sha256:
 8035b87358fff93251e9dcb0fd430aa5a715bd420e762981e69a55f01e61e6f5 2304 radicale_1.1.1+20160115-4.dsc
 65daa297f1a8a5deadbf44eb0af82dfaaba21c683d4f9084e7043db6d4eff3b3 24936 radicale_1.1.1+20160115-4.debian.tar.xz
 5a171798d516070373a7de99a23e9911aee93469debbf609697d6becee5deba4 8469 radicale_1.1.1+20160115-4_amd64.buildinfo
Files:
 cfb58bf3abcb51508a87406afb213ec3 2304 web optional radicale_1.1.1+20160115-4.dsc
 0641b73a7a4cb84724050ab399c92e6f 24936 web optional radicale_1.1.1+20160115-4.debian.tar.xz
 e6daa07337bfca7416a27a3d419010ba 8469 web optional radicale_1.1.1+20160115-4_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAlkFkcsACgkQLHwxRsGg
ASGTrQ/7Bd6IEh4iRbUeSoXBY7aPd+Ob34zKH1nrjUuN5GOm1gOyf4WYNbt5fNwT
I6Fqc8NJJa0OTcqwBx62r9RNeeYNQeqcTpH8Nb3rbDRuCL3TyXlVULFSoHDOC/B4
Co91rEmrjZ3MI+HDCKOxCs6Ifh4w4XrX/0jAWpwdXlCZ4I9vPTMcrDEDy64p8Qwx
s2IkvKOGRsthRTCW1dG1dxjXlIG0KWgz5ddbgz2+xStTQ10YHxoCUInC18j3BVOY
TzBxC48FKwT5b75jd+nyv3o2d73IbWKmHCn4LleHHVJDRgSWkweMlQFi/BeS2gOU
KMPTVAPh4LKEpEeQ9hzxxWEdXwys0UrgYHBvgoERN8May37YNwMwse1J0O73CIZz
xkNiSbOAKXUZLQ9xUkBCzvstxeXkmQ6Hx8mlpBv732ZcaCpVgXXwOXmLls77kQvW
0gzn0RbWo/I4Y0IKRDfFsOzoDbOVXHSdJBz/7SXcx4xKbirtj9lSnmeY9zzvitEt
z+qeKSenE69B5Q9pZiCRmkIpF+BRTHUhULoBdioY5HB5qJC+AtzTYvuTb+e8vj40
TPrg/egkvWzzw6Nb9vIkH1I3r4DsQTrX/M2lSVe+ZcKUTKKEAQfe3crYls8lyWgz
La1mO2NJF+ssClkSGG4wI2ZYilNuJzn2uLAzoR+YeiafI6Bf/mA=
=ucvL
-----END PGP SIGNATURE-----

Message #26 received at 861514@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Jonas Smedegaard <dr@jones.dk>, 861514@bugs.debian.org

Subject: Re: Bug#861514: radicale: htpasswd authentication vulnerable to timing-based bruteforce attacks

Date: Sun, 30 Apr 2017 20:21:01 +0200

Hi

This issue has been assigned CVE-2017-8342 via the cveform at MITRE.

Regards,
Slavatore

Message #39 received at 861514-done@bugs.debian.org (full text, mbox, reply):

From: Jonas Smedegaard <dr@jones.dk>

To: 861514-done@bugs.debian.org

Subject: Re: radicale: htpasswd authentication vulnerable to timing-based bruteforce attacks

Date: Sun, 23 Sep 2018 20:54:43 +0200

[Message part 1 (text/plain, inline)]

Version: 2.0.0~rc2-1

Quoting Jonas Smedegaard (2017-04-30 00:40:27)
> Upstream has issued a security release:
> 
> > Add a random timer to avoid timing oracles and simple bruteforce
> > attacks when using the htpasswd authentication method.

This was fixed since 2.0.0~rc2-1.

 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.