[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 30 Jan 2012 23:32:12 +0200
From: Nanakos Chrysostomos <nanakos@...ed-net.gr>
To: Kurt Seifried <kseifried@...hat.com>
Cc: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
Jonathan Wiltshire <jmw@...ian.org>,
Gian Piero Carrubba <gpiero@...rf.it>,
"team@...urity.debian.org" <team@...urity.debian.org>
Subject: Re: Re: Yubiserver package ships with pre-filled identities
On 30 Ιαν 2012, at 19:08, Kurt Seifried <kseifried@...hat.com> wrote:
> On 01/30/2012 04:56 AM, Jonathan Wiltshire wrote:
>> On 2012-01-30 06:43, Nanakos Chrysostomos wrote:
>>> Hi again,
>>> I found another reason for not shipping the package with an example
>>> account. I think you are certainly right. If you haven't filled a
>>> bug
>>> please do so, in the meanwhile I will upload to mentors a new
>>> version
>>> with an empty database that resolves the problem. Thanks.
>>
>> This populated database is also shipped in the upstream tarball,
>> oss-security should be consulted to see whether a CVE identifier
>> should
>> be issued.
>>
>> Adding to CC; oss-sec please see below:
>>
>>
>>> On 30 Ιαν 2012, at 1:25, Gian Piero Carrubba <gpiero@...rf.it> w
>>> rote:
>>>
>>>> Hi Nanakos,
>>>>
>>>> thanks for your prompt response.
>>>>
>>>> * [Sun, Jan 29, 2012 at 11:19:37PM +0200] Nanakos Chrysostomos:
>>>>> those keys are invalid and are not my real keys. It's just a
>>>>> sample
>>>>> for the potential users of the package to see.
>
> Ok I'm not clear on what is going on here, is there a link to the bug
> entry regarding this issue, or can someone clarify it?
>
Hi,
there is no bug entry yet.
> 1) are there default accounts shipped with the product that get
> activated automatically during install? (it sounds like yes?)
>
Yes. The database is populated with an example/test account which is
activated during install.
> 2) can someone remotely/locally access these accounts? what are the
> credentials for these accounts ("invalid keys"?), can an attacker
> access
> them?
>
If someone programs or uses a software emulation for the yubikey can
have access to whatever the user of the application uses it for ( the
yubiserver). For example if someone uses Pam yubico module with the su
or sshd server to provide a two factor authentication scheme he should
suffer from this security issue if he hasn't deleted or deactivated
the test account. If someone by mistake installs yubiserver and
doesn't use him to validate his otp or hmac otp, he won't suffer from
this security issue. Someone can only suffer if he uses the server and
hasn't deleted or deactivated the test account which is shipped with
the server.
> 3) what is the privilege level of the accounts?
That depends on how someone wants to use the server and the privilege
level that he wants to give to it's users through the validation of
the otp or hmac otp.
Chris.
>
> --
> Kurt Seifried Red Hat Security Response Team (SRT)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
