busybox: passwd uses null salt (weak encryption) [CVE-2006-1058]

Debian Bug report logs - #360578
busybox: passwd uses null salt (weak encryption) [CVE-2006-1058]

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <martin.pitt@ubuntu.com>

To: Debian BTS Submit <submit@bugs.debian.org>

Subject: busybox: passwd uses null salt (weak encryption) [CVE-2006-1058]

Date: Mon, 3 Apr 2006 14:03:36 +0200

[Message part 1 (text/plain, inline)]

Package: busybox
Version: 1.01-4
Severity: normal
Tags: security yatch

busybox' passwd always uses an empty salt for md5 passwords, so that
passwords can be broken much faster (with fast table-based
approaches). Please see [1] for the upstream bug report and [2] for
the Ubuntu patch.

Thank you,

Martin

[1] http://bugs.busybox.net/view.php?id=604
[2] http://patches.ubuntu.com/patches/busybox.CVE-2006-1058.diff

-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

In a world without walls and fences, who needs Windows and Gates?

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 360578@bugs.debian.org (full text, mbox, reply):

From: Julien Goodwin <jgoodwin@studio442.com.au>

To: 360578@bugs.debian.org

Subject: Update

Date: Fri, 23 Jun 2006 04:14:25 +1000

[Message part 1 (text/plain, inline)]

The Ubuntu patch link from Martin's report is now a 404, and the busybox
 bug report is listed as being fixed on the 20th of April.

Relevent SVN commit: (trunk)
http://www.busybox.net/cgi-bin/viewcvs.cgi/trunk/busybox/loginutils/passwd.c?rev=14930&view=diff&r1=14930&r2=14929&p1=trunk/busybox/loginutils/passwd.c&p2=/trunk/busybox/loginutils/passwd.c
And from the 1.1.3 tag:
http://www.busybox.net/cgi-bin/viewcvs.cgi/tags/busybox_1_1_3/loginutils/passwd.c?rev=15117&view=log

As busybox 1.1.3 is now in unstable this bug should be marked fixed in 1.1.3

Thanks,
Julien

[signature.asc (application/pgp-signature, attachment)]

Message #17 received at 360578-done@bugs.debian.org (full text, mbox, reply):

From: Frans Pop <elendil@planet.nl>

To: Julien Goodwin <jgoodwin@studio442.com.au>, 360578-done@bugs.debian.org

Subject: Re: Bug#360578: Update

Date: Thu, 22 Jun 2006 20:39:22 +0200

Version: 1:1.1.3-1

On Thursday 22 June 2006 20:14, Julien Goodwin wrote:
> As busybox 1.1.3 is now in unstable this bug should be marked fixed in
> 1.1.3

Done. Thanks.

Send a report that this bug log contains spam.