password limited to seven, not eight characters

Debian Bug report logs - #509882
password limited to seven, not eight characters

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Thijs Kinkhorst <thijs@debian.org>

To: submit@bugs.debian.org

Subject: password limited to seven, not eight characters

Date: Sat, 27 Dec 2008 13:30:15 +0100

[Message part 1 (text/plain, inline)]

Package: qemu
Severity: important
Tags: security, patch

Hi,

It has been reported that the password setting routine in qemu limits the 
password length to 7 instead of 8 characters as intended:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5714

It would be very desirable to fix this in lenny, because it could be regarded 
to be a security issue in a way. Etch seems not affected.

Please reference the CVE id when fixing this issue.


thanks,
Thijs

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 509882-done@bugs.debian.org (full text, mbox, reply):

From: Aurelien Jarno <aurelien@aurel32.net>

To: Thijs Kinkhorst <thijs@debian.org>, 509882-done@bugs.debian.org

Subject: Re: Bug#509882: password limited to seven, not eight characters

Date: Sun, 28 Dec 2008 12:41:28 +0100

Version: 0.9.1+svn20081214-1

On Sat, Dec 27, 2008 at 01:30:15PM +0100, Thijs Kinkhorst wrote:
> Package: qemu
> Severity: important
> Tags: security, patch
> 
> Hi,
> 
> It has been reported that the password setting routine in qemu limits the 
> password length to 7 instead of 8 characters as intended:
> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5714
> 
> It would be very desirable to fix this in lenny, because it could be regarded 
> to be a security issue in a way. Etch seems not affected.
> 
> Please reference the CVE id when fixing this issue.
> 

To honest, while I agree it is a real problem, I found strange it is
considered as a security problem with a CVE entry. Note also this 
problem does not occurs for the initial setting of the password, but 
only when changing it.

Given we now have a CVE entry, I'll fix the bug in lenny/unstable. For
the experimental version, I am closing the bug for the experimental 
version, as it is a SVN snapshot and the bug has already been fixed
for some days upstream.

Note that KVM is also most probably affected.

-- 
  .''`.  Aurelien Jarno	            | GPG: 1024D/F1BCDB73
 : :' :  Debian developer           | Electrical Engineer
 `. `'   aurel32@debian.org         | aurelien@aurel32.net
   `-    people.debian.org/~aurel32 | www.aurel32.net

Message #21 received at 509882@bugs.debian.org (full text, mbox, reply):

From: "Thijs Kinkhorst" <thijs@debian.org>

To: "Aurelien Jarno" <aurelien@aurel32.net>

Cc: 509882@bugs.debian.org

Subject: Re: Bug#509882: password limited to seven, not eight characters

Date: Sun, 28 Dec 2008 13:37:52 +0100 (CET)

On Sun, December 28, 2008 12:41, Aurelien Jarno wrote:
> To honest, while I agree it is a real problem, I found strange it is
> considered as a security problem with a CVE entry. Note also this problem
> does not occurs for the initial setting of the password, but only when
> changing it.

Yes, in my opinion it borders on a non-issue, but stictly speaking it's
less secure than intended so that qualifies for a CVE name. But still, if
we can fix it for lenny, we should.

> Given we now have a CVE entry, I'll fix the bug in lenny/unstable. For
> the experimental version, I am closing the bug for the experimental
> version, as it is a SVN snapshot and the bug has already been fixed for
> some days upstream.

Great, thanks.


Thijs

Message #26 received at 509882-done@bugs.debian.org (full text, mbox, reply):

From: Aurelien Jarno <aurelien@aurel32.net>

To: Thijs Kinkhorst <thijs@debian.org>

Cc: 509882-done@bugs.debian.org

Subject: Re: Bug#509882: password limited to seven, not eight characters

Date: Sun, 28 Dec 2008 14:12:16 +0100

Version 0.9.1-10

On Sun, Dec 28, 2008 at 01:37:52PM +0100, Thijs Kinkhorst wrote:
> On Sun, December 28, 2008 12:41, Aurelien Jarno wrote:
> > To honest, while I agree it is a real problem, I found strange it is
> > considered as a security problem with a CVE entry. Note also this problem
> > does not occurs for the initial setting of the password, but only when
> > changing it.
> 
> Yes, in my opinion it borders on a non-issue, but stictly speaking it's
> less secure than intended so that qualifies for a CVE name. But still, if
> we can fix it for lenny, we should.
> 
> > Given we now have a CVE entry, I'll fix the bug in lenny/unstable. For
> > the experimental version, I am closing the bug for the experimental
> > version, as it is a SVN snapshot and the bug has already been fixed for
> > some days upstream.
> 
> Great, thanks.

Done, but I forget to add the bug number in the changelog. Closing the
bug manually with this mail.

-- 
  .''`.  Aurelien Jarno	            | GPG: 1024D/F1BCDB73
 : :' :  Debian developer           | Electrical Engineer
 `. `'   aurel32@debian.org         | aurelien@aurel32.net
   `-    people.debian.org/~aurel32 | www.aurel32.net

Send a report that this bug log contains spam.