Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 6 Aug 2015 21:28:04 +0300
From: Solar Designer <>
Subject: Re: auditing our use of FMT_* flags (was: more robustness)

On Tue, Aug 04, 2015 at 08:57:29AM +0800, Kai Zhao wrote:
>     2.1 formats have not set FMT_CASE but there is at least one
>           password which is case-sensitive
>         LM, WoWSRP, mssql, nethalflm, netlm, oracle, sapb, saph

For LM, I have explained the situation here:

You need to enhance your test.  For nethalflm and netlm, it's probably
the same thing.

For the rest, I'd like others to comment.  (I think some of these
formats got fixes committed already.)

>     2.2 formats have set FMT_CASE but all passwords are
>           case-insensitive
>         OpenVMS

In uaf_encode.c: uaf_test_password() we have:

    if ( pwd->flags & UAI$M_PWDMIX ) {  /* take password verbatim */
        password_dx.dsc$a_pointer = (char *) password;
    } else {
         * Upcase password.
        password_dx.dsc$a_pointer = uc_password;
        if ( password_dx.dsc$w_length > sizeof(uc_password) )
                password_dx.dsc$w_length = sizeof(uc_password);
        for ( i = 0; i < password_dx.dsc$w_length; i++ )
                uc_password[i] = toupper ( ARCH_INDEX(password[i]) );

So it's not that simple.  Can you try to come up with and add test
vectors that would exercise the "else" code path?

Kai, you'll need to keep track of these issues, and perhaps post a
summary of the remaining ones a week later.  Thanks!


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.