oss-security - RE: CVE request: python-pyrad insecurities

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Feb 2013 19:51:07 +0000
From: "Christey, Steven M." <coley@...re.org>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
CC: Vincent Danen <vdanen@...hat.com>
Subject: RE: CVE request: python-pyrad insecurities

These two issues were fixed in the same diff and reflect poor randomness - should we have only assigned one CVE?  (If the RADIUS feature was introduced in different versions than the authenticator-password feature, then maybe the SPLIT is acceptable.)


- Steve


-----Original Message-----
From: Kurt Seifried [mailto:kseifried@...hat.com] 
Sent: Friday, February 15, 2013 2:37 PM
To: oss-security@...ts.openwall.com
Cc: Vincent Danen
Subject: Re: [oss-security] CVE request: python-pyrad insecurities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/15/2013 09:14 AM, Vincent Danen wrote:
> Could a CVE be assigned to the following two issues please?
> 
> #1: https://bugzilla.redhat.com/show_bug.cgi?id=911682
> 
> Nathaniel McCallum of Red Hat reported that pyrad was using
> Python's random module in a number of places to generate
> pseudo-random data.  In the case of the authenticator data, it was
> being used to secure a password sent over the wire.  Because
> Python's random module is not really suited for this purpose (not
> random enough), it could lead to password hashing that may be
> predictable.

Please use CVE-2013-0294 for this issue.


> #2: https://bugzilla.redhat.com/show_bug.cgi?id=911685
> 
> Nathaniel McCallum of Red Hat reported that pyrad was creating 
> serialized RADIUS packet IDs in the CreateID() function in
> packet.py. This is not suitable for RADIUS as the RFC specifies
> that the ID must not be predictable.  As a result, the ID of the
> next packet sent can be spoofed.

Please use CVE-2013-0295 for this issue.

> 
> These have been corrected in upstream's forthcoming version 2.1
> via:
> 
> https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5
>
> 
> 


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRHo5KAAoJEBYNRVNeJnmT32YP/RUrucNudALgorUcvGb12Btf
Xtp5JPu+nYZDWq+i1au4ZMc1TZv12LKSErrvxaQZT04f6K6NvD74drqtHXf1a5ck
NWAsk/RIRFrNmSvwkmL02352LWzKlPLfM7ZsiJgU73XEPmkLYdVCTopgGzKYaWYe
vWKd7C3l1a/2b2I2C+O2OT2jyi89K3LQSzdZVSd7Mf81gDtDnkyQ8RT5QpcCPVRa
XbfKdfzVdLNEw26n5k8/alpjvBARyv4KA7ZA4qQzaI9P32Nw1DFE/8zBbrHkrhj5
V83HyOtQyqrYryreNahGkBtLc1LQZ8b81pOvNaE2FRVgA7M5VA4JH4OaL8NCornJ
ozicUuB/U32D24Ox7UqR+nkScPCBAhj/iVz+lkKac3WHLNGJGSa25WwWjoaWPrip
YaFZHzyijIAdYsr7tHoxTncKNhqtCClyiX6RZdPKKAfDGFV4hPfktwOY8Di6u+hM
B8ANPe+nDi7kB4BQcm5Qj7RJ7KY0eixxYgv4ynhvvmdDlpFJwGh8rIilmCCGdVMa
GDYjVzgR/SXTFOYWZ9pWc90Ixa3wNtqiCHNwUqKmKldHZvyph0XS4K0HM/o0IQny
0aHSg04nSM9jlUOczlCwShhTrRHmTkkuRkXsVlv0ibtORTwcotD/9xghkLK9ktHb
3HiFhtqk0CvJBtNMFcRG
=z9JH
-----END PGP SIGNATURE-----
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.