oss-security - KDE Paste Applet

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 28 May 2013 21:16:46 +1000
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com, bugtraq@...urityfocus.com
Subject: KDE Paste Applet

The paste applet included with kdeplasma-addons allows you to define
macros that will copy some generated data into the clipboard, using
simple macros to define the source and format of the data.

The available macros include %{password(...)} which generates "random"
passwords.

Here is the code that generates the passwords (from pastemacroexpander.cpp):

    QDateTime now = QDateTime::currentDateTime();
    qsrand(now.toTime_t() / now.time().msec());
    for (int i = 0; i < charCount; ++i) {
        result += chars[qrand() % chars.count()];
    }

Breaking passwords generated by this (for example from leaked password
hashes) can be done extremely quickly, especially if a password expiry
or other hint is stored with the password.

Workaround: You can change the macro you were using to a %{exec(...)}
macro which calls a secure password generator.  Please select your
replacement carefully.

I reported this to security@....org and created a launchpad ticket
against the Ubuntu package on May 13, followed up with a proof of
concept on the 17th, and have received no response at all from either.
 Apologies if that was the wrong contact method.

Regards,
  Michael

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.