[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <8aaf4ad0-dd79-9452-0e5d-af35c186b63d@mirbsd.de>
Date: Sat, 7 Nov 2026 23:00:13 +0100 (CET)
From: Thorsten Glaser <tg@...bsd.de>
To: musl@...ts.openwall.com
Subject: Re: OpenSSH password auth bypass analysis
On Sat, 7 Nov 2026, Rich Felker wrote:
>But we could do the fallback only when validating (the input salt has
>a hash with it) not when generating new passwords (setting part only).
This… does not read well on first pass.
While, yes, all straightforward applications would do that,
there may exist applications that only pass the setting part
when validating.
Something that has (documented) insight into the hashes.
Something… like PHP’s wrapper around libc’s crypt(3), perhaps
(I have not looked, but this sounds *exactly* like what PHP
would do, either in an older version, or as a (newer) response
to some perceived security issue).
This has the chance to backfire in that only the first eight
bytes will be tested. I’d personally not do that.
bye,
//mirabilos
--
„Cool, /usr/share/doc/mksh/examples/uhr.gz ist ja ein Grund,
mksh auf jedem System zu installieren.“
-- XTaran auf der OpenRheinRuhr, ganz begeistert
(EN: “[…]uhr.gz is a reason to install mksh on every system.”)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
