Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 1 Jan 2014 22:14:09 +0100
From: Frank Dittrich <>
Subject: Re: Some bleeding-jumbo formats with SEGV and ABRT

On 12/28/2013 10:07 PM, Frank Dittrich wrote:
> I used Alexander's fuzzing scripts.
> Django, netlmv2, openssl-enc and rar formats failed with SEGV.
> LUKS format failed with ABRT.

The netlmv2 is not reproducible with linux-x86-native, all the others are.

The rar crash only occurs when cracking has started (i.e., not with
All the other crashes are reproducible even with an empty word list.

Here's another hash which causes a crash in openssl-enc.
It is much shorter than the one I included in my previous mail:


Further testing also revealed another bug:
The attached file fail_clipperz causes a failing self test, reproducible
with linux-x86-native and linux-x86-64-native:

(bleeding-jumbo)run $ ./john fail_clipperz
Loaded 2 password hashes with 2 different salts (Clipperz, SRP [SHA256
32/32 oSSL-exp])
Self test failed (get_hash[0](0))

./john --test works for --format=clipperz.

But each of the two lines in fail_clipperz causes the self test to fail.
I guess valid() needs to be enhanced to avoid loading these hashes.


View attachment "fail_clipperz" of type "text/plain" (326 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.