[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 06 Jul 2011 08:04:36 -0500
From: Jamie Strandboge <jamie@...onical.com>
To: coley@...us.mitre.org
Cc: oss-security@...ts.openwall.com, security@...ntu.com,
security@...ian.org
Subject: CVE Request: reseed
On Wed, 2011-07-06 at 07:47 -0500, Jamie Strandboge wrote:
> A security bug was reported by Jeffrey Walton against reseed in
> Ubuntu. You are being emailed as the upstream contact. Please keep
> oss-security@...ts.openwall.com[1] CC'd for any updates on this issue.
>
> This issue should be considered public. A CVE is being requested; please
> mention this in any changelogs.
>
> Details from the public bug follow:
> https://launchpad.net/bugs/804594
>
> From the reporter:
> "reseed(8) performs an insecure HTTP fetch of data from random.org. The
> script is automatically executed when installed, and any time the user
> chooses to execute. In addition, the reseed man pages do not mention the
> data is retrieved over an insecure channel."
>
> As pointed out by the reporter, from the man page: "It is run once
> during the installation of the package only". An attacker could perform
> a MITM during package installation or whenever the reseed command is run
> to provide predictable data for the random number seed.
While the attack is difficult to achieve (need both MITM at time of
package installation AIUI), it seems that this still should get a CVE.
Thanks!
--
Jamie Strandboge | http://www.canonical.com
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
