[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Jun 2012 22:09:48 +0200
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-dev@...ts.openwall.com
Subject: incomplete valid() tests for many jumbo formats
This is probably something that has to wait until after jumbo-6 is released.
Several formats use very limited tests in valid().
Best case scenario is that the format tries to crack hashes which are
invalid, worst case scenario is that various errors can occur if someone
passes data which will overflow buffers.
The sooner we fix this, the sooner other contributors creating patches
for new formats or for GPU implementations of existing formats will find
better examples of how to implement valid().
Examples:
cuda_pwsafe_fmt.c:53:static int valid(char *ciphertext, struct fmt_main
*pFmt)
cuda_pwsafe_fmt.c-54-{
cuda_pwsafe_fmt.c-55- return !strncmp(ciphertext, "$pwsafe$", 8);
cuda_pwsafe_fmt.c-56-}
probably just copied from the CPU implementation (pwsafe_fmt_plug.c)
like many other CUDA and OpenCL implementations
django_fmt.c:78:static int valid(char *ciphertext, struct fmt_main *pFmt)
django_fmt.c-79-{
django_fmt.c-80- return !strncmp(ciphertext, "$django$", 8);
django_fmt.c-81-}
episerver_fmt_plug.c:97:static int valid(char *ciphertext, struct
fmt_main *pFmt)
episerver_fmt_plug.c-98-{
episerver_fmt_plug.c-99- return !strncmp(ciphertext,
"$episerver$", 11);
episerver_fmt_plug.c-100-}
keepass_fmt_plug.c:127:static int valid(char *ciphertext, struct
fmt_main *pFmt)
keepass_fmt_plug.c-128-{
keepass_fmt_plug.c-129- return !strncmp(ciphertext, "$keepass$", 9);
keepass_fmt_plug.c-130-}
keychain_fmt_plug.c:75:static int valid(char *ciphertext, struct
fmt_main *pFmt)
keychain_fmt_plug.c-76-{
keychain_fmt_plug.c-77- return !strncmp(ciphertext, "$keychain$", 10);
keychain_fmt_plug.c-78-}
mozilla_fmt.c:116:static int valid(char *ciphertext, struct fmt_main *pFmt)
mozilla_fmt.c-117-{
mozilla_fmt.c-118- return !strncmp(ciphertext, "$mozilla$", 9);
mozilla_fmt.c-119-}
nsldap_fmt_plug.c:92:static int valid(char *ciphertext, struct fmt_main
*pFmt)
nsldap_fmt_plug.c-93-{
nsldap_fmt_plug.c-94- if (ciphertext && strlen(ciphertext) ==
CIPHERTEXT_LENGTH)
nsldap_fmt_plug.c-95- return !strncasecmp(ciphertext,
NSLDAP_MAGIC, NSLDAP_MAGIC_LENGTH);
nsldap_fmt_plug.c-96- return 0;
nsldap_fmt_plug.c-97-}
odf_fmt_plug.c:78:static int valid(char *ciphertext, struct fmt_main *pFmt)
odf_fmt_plug.c-79-{
odf_fmt_plug.c-80- return !strncmp(ciphertext, "$odf$", 5);
odf_fmt_plug.c-81-}
office_fmt_plug.c:267:static int valid(char *ciphertext, struct fmt_main
*pFmt)
office_fmt_plug.c-268-{
office_fmt_plug.c-269- return !strncmp(ciphertext, "$office$", 8);
office_fmt_plug.c-270-}
opencl_nsldaps_fmt.c:367:static int valid(char *ciphertext, struct
fmt_main *pFmt)
opencl_nsldaps_fmt.c-368-{
opencl_nsldaps_fmt.c-369- if (ciphertext && strlen(ciphertext) ==
CIPHERTEXT_LENGTH + NSLDAP_MAGIC_LENGTH)
opencl_nsldaps_fmt.c-370- return !strncasecmp(ciphertext,
NSLDAP_MAGIC, NSLDAP_MAGIC_LENGTH);
opencl_nsldaps_fmt.c-371- return 0;
opencl_nsldaps_fmt.c-372-}
opencl_pwsafe_fmt.c:132:static int valid(char *ciphertext, struct
fmt_main *pFmt)
opencl_pwsafe_fmt.c-133-{
opencl_pwsafe_fmt.c-134- return !strncmp(ciphertext, "$pwsafe$", 8);
opencl_pwsafe_fmt.c-135-}
pdf_fmt.c:68:static int valid(char *ciphertext, struct fmt_main *pFmt)
pdf_fmt.c-69-{
pdf_fmt.c-70- return !strncmp(ciphertext, "$pdf$", 5);
pdf_fmt.c-71-}
pwsafe_fmt_plug.c:77:static int valid(char *ciphertext, struct fmt_main
*pFmt)
pwsafe_fmt_plug.c-78-{
pwsafe_fmt_plug.c-79- return !strncmp(ciphertext, "$pwsafe$", 8);
pwsafe_fmt_plug.c-80-}
racf_fmt_plug.c:139:static int valid(char *ciphertext, struct fmt_main
*pFmt)
racf_fmt_plug.c-140-{
racf_fmt_plug.c-141- return !strncmp(ciphertext, "$racf$", 6);
racf_fmt_plug.c-142-}
rar_fmt.c:684:static int valid(char *ciphertext, struct fmt_main *pFmt)
rar_fmt.c-685-{
rar_fmt.c-686- return !strncmp(ciphertext, "$RAR3$*", 7);
rar_fmt.c-687-}
sip_fmt_plug.c:74:static int valid(char *ciphertext, struct fmt_main *pFmt)
sip_fmt_plug.c-75-{
sip_fmt_plug.c-76- return !strncmp(ciphertext, "$sip$", 5);
sip_fmt_plug.c-77-}
ssh_fmt.c:98:static int valid(char *ciphertext, struct fmt_main *pFmt)
ssh_fmt.c-99-{
ssh_fmt.c-100- return !strncmp(ciphertext, "$ssh2$", 6);
ssh_fmt.c-101-}
vnc_fmt_plug.c:113:static int valid(char *ciphertext, struct fmt_main *pFmt)
vnc_fmt_plug.c-114-{
vnc_fmt_plug.c-115- return !strncmp(ciphertext, "$vnc$", 5);
vnc_fmt_plug.c-116-}
wbb3_fmt_plug.c:94:static int valid(char *ciphertext, struct fmt_main *pFmt)
wbb3_fmt_plug.c-95-{
wbb3_fmt_plug.c-96- return !strncmp(ciphertext, "$wbb3$", 6);
wbb3_fmt_plug.c-97-}
zip_fmt.c:56:static int valid(char *ciphertext, struct fmt_main *pFmt)
zip_fmt.c-57-{
zip_fmt.c-58- return !strncmp(ciphertext, "$zip$*", 6);
zip_fmt.c-59-}
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
