new upstream version fixes security problem with the secret file (CVE-2012-6140)

Debian Bug report logs - #666129
new upstream version fixes security problem with the secret file (CVE-2012-6140)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Faidon Liambotis <paravoid@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Please update to a newer upstream release

Date: Thu, 29 Mar 2012 00:59:56 +0300

Package: libpam-google-authenticator
Version: 20110413.68230188bdc7-1.1
Severity: wishlist

Hi,

I would like to have a newer version of google-authenticator in the
archive; the version currently in Debian is almost a year old and
several new features have been added to upstream's trunk (it's
unfortunate that upstream doesn't believe in "releases"…).

In particular, I was interested in having counter-based HOTP instead of
TOTP, since the box I want to use libpam-google-authenticator in doesn't
have an RTC and relying into not having network outages (for NTP) is a
no-go for this. I was happy to see that upstream supports this, only to
be disappointed that this isn't in Debian :-)

If you're busy, I can certainly help with the upload and do an NMU,
although I'm afraid I don't have the time or will to help with the
maintenance in general.

Thanks, and thank you for packaging google-authenticator. 

Regards,
Faidon

Message #10 received at 666129@bugs.debian.org (full text, mbox, reply):

From: rk <neoice@neoice.net>

To: 666129@bugs.debian.org

Subject: RE: Please update to a newer upstream release

Date: Sat, 22 Sep 2012 00:12:10 -0700

There is also a severe and somewhat undocumented security issue fixed
by the "user=" parameter added in this commit:
https://code.google.com/p/google-authenticator/source/detail?r=c3414e9857ad64e52283f3266065ef3023fc69a8

Without this option, the SECRET file is required to be user-readable
which can expose the secret to an attacker under certain
configurations (notably when required for `sudo`, but not system
login).

Message #15 received at 666129@bugs.debian.org (full text, mbox, reply):

From: Phil Armstrong <phil@kantaka.co.uk>

To: Debian Bug Tracking System <666129@bugs.debian.org>

Subject: Re: Please update to a newer upstream release

Date: Wed, 24 Oct 2012 16:42:55 +0100

Package: libpam-google-authenticator
Version: 20110413.68230188bdc7-1.1
Followup-For: Bug #666129

Upstream released version 1.0 in May by the way:

  http://code.google.com/p/google-authenticator/downloads/detail?name=libpam-google-authenticator-1.0-source.tar.bz2

cheers, Phil

Message #20 received at 666129@bugs.debian.org (full text, mbox, reply):

From: Alexander Wirt <formorer@debian.org>

To: rk <neoice@neoice.net>

Cc: 666129@bugs.debian.org

Subject: Re: Bug#666129: Please update to a newer upstream release

Date: Thu, 18 Apr 2013 09:13:24 +0200

tag 666129 security
severity 666129 critical
retitle 666129 new upstream version fixes security problem with the secret file
thanks

On Sat, 22 Sep 2012, rk wrote:

> There is also a severe and somewhat undocumented security issue fixed
> by the "user=" parameter added in this commit:
> https://code.google.com/p/google-authenticator/source/detail?r=c3414e9857ad64e52283f3266065ef3023fc69a8
> 
> Without this option, the SECRET file is required to be user-readable
> which can expose the secret to an attacker under certain
> configurations (notably when required for `sudo`, but not system
> login).
This is indeed a security problem. Lenart, do you need any help to get the
package updated? I also think it doesn't make sense to ship the package in
this state with wheezy and there I asked for removal from testing.

Alex

Message #31 received at 666129@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Alexander Wirt <formorer@debian.org>, 666129@bugs.debian.org

Cc: rk <neoice@neoice.net>

Subject: Re: Bug#666129: Please update to a newer upstream release

Date: Thu, 18 Apr 2013 21:28:10 +0200

Control: retitle 666129 new upstream version fixes security problem with the secret file (CVE-2012-6140)

Hi all

On Thu, Apr 18, 2013 at 09:13:24AM +0200, Alexander Wirt wrote:
> tag 666129 security
> severity 666129 critical
> retitle 666129 new upstream version fixes security problem with the secret file
> thanks
> 
> On Sat, 22 Sep 2012, rk wrote:
> 
> > There is also a severe and somewhat undocumented security issue fixed
> > by the "user=" parameter added in this commit:
> > https://code.google.com/p/google-authenticator/source/detail?r=c3414e9857ad64e52283f3266065ef3023fc69a8
> > 
> > Without this option, the SECRET file is required to be user-readable
> > which can expose the secret to an attacker under certain
> > configurations (notably when required for `sudo`, but not system
> > login).
> This is indeed a security problem. Lenart, do you need any help to get the
> package updated? I also think it doesn't make sense to ship the package in
> this state with wheezy and there I asked for removal from testing.

A CVE was assigned for this issue: CVE-2012-6140, see[1].

 [1]: http://marc.info/?l=oss-security&m=136630281802738&w=2

Regards,
Salvatore

Message #38 received at 666129@bugs.debian.org (full text, mbox, reply):

From: Mr Allwyn Fernandes <dbwerwesklsdf@stobor.net>

To: LENART Janos <ocsi@debian.org>, 666129@bugs.debian.org

Subject: NMU to latest git?

Date: Mon, 27 May 2013 18:29:01 +1000

Hi Lenart,

Just wondering if you are planning to update google-authenticator to a newer 
version, as per bugs #666129 and #660188, or if you mind if I do an NMU? I had 
built a deb from git HEAD a few months ago, and have the relevant files handy 
to submit if you don't have the time to look at it.

Cheers,

Allwyn.

Message #43 received at 666129@bugs.debian.org (full text, mbox, reply):

From: Janos LENART <ocsi@debian.org>

To: Mr Allwyn Fernandes <dbwerwesklsdf@stobor.net>, 666129@bugs.debian.org

Subject: Re: Bug#666129: NMU to latest git?

Date: Wed, 29 May 2013 21:56:43 +0100

[Message part 1 (text/plain, inline)]

In progress, sorry for the delay
google-authenticator_20130529-1_amd64.changes uploaded successfully to
localhost
along with the files:
  google-authenticator_20130529-1.dsc
  google-authenticator_20130529.orig.tar.gz
  google-authenticator_20130529-1.debian.tar.gz
  libpam-google-authenticator_20130529-1_amd64.deb

Greetings,

        Your Debian queue daemon (running on host franck.debian.org)


On 27 May 2013 09:29, Mr Allwyn Fernandes <dbwerwesklsdf@stobor.net> wrote:

> Hi Lenart,
>
> Just wondering if you are planning to update google-authenticator to a
> newer
> version, as per bugs #666129 and #660188, or if you mind if I do an NMU? I
> had
> built a deb from git HEAD a few months ago, and have the relevant files
> handy
> to submit if you don't have the time to look at it.
>
> Cheers,
>
> Allwyn.
>



-- 
LÉNÁRT, János
<ocsi@debian.org>

[Message part 2 (text/html, inline)]

Message #52 received at 666129-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 666129-submitter@bugs.debian.org

Subject: closing 666129

Date: Thu, 30 May 2013 07:23:03 +0200

close 666129 20130529-1
thanks

New version in unstable (20130529-1)

Send a report that this bug log contains spam.