Date: Thu, 9 Aug 2012 05:51:04 +0400 From: Solar Designer <solar@...nwall.com> To: musl@...ts.openwall.com Subject: Re: crypt* files in crypt directory On Wed, Aug 08, 2012 at 09:06:23AM -0400, Rich Felker wrote: > Actually this brings up a HUGE DoS vuln in blowfish crypt: with tcb > passwords, a malicious user can put a password with count=31 (it's > logarithmic, so this means 2^31) in their tcb shadow file. Yes, but only after having compromised group shadow. If a user does compromise group shadow, I'd appreciate learning of that - even if via being DoS'ed. ;-) Direct access to tcb shadow files should not be available for other reasons as well, including password policy enforcement and not assisting in exploitation of read-any-file vulnerabilities e.g. in web apps into remote shell access. If you implement tcb differently, then _that_ should be fixed. It is not a musl issue since musl does not set file permissions (nor is it supposed to). Whatever you use to create/update the files may need to be fixed. > I don't know how to solve it, but in musl I think we'll have to put a > low limit on count if we're going to support blowfish. That's not good. BTW, the extended DES-based hashes that are already supported in musl allow for variable iteration counts encoded along with hashes too, and that's the way it should be. > Unfortunately I > don't see a good way to make it runtime configurable without > hard-coding additional non-standard config paths, but letting the DoS > bug slip in is not acceptable. I agree that allowing for the DoS without the attacker having to find and exploit a vulnerability first is not acceptable, but the issue is not in crypt_blowfish nor in musl per se. Our tcb suite as released by Openwall does not provide direct access to those files. It protects them with group shadow. Do you have any released (rather than private use) software that makes tcb shadow files user-writable without requiring any group privileges? If not, then this issue should not affect musl development in any way, and you may fix whatever you use privately as a separate step. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.