oss-security - Re: CVE Request: reseed

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 12 Jul 2011 14:57:20 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: security@...ntu.com, security@...ian.org, coley@...us.mitre.org
Subject: Re: CVE Request: reseed

----- Original Message -----
> On Wed, 2011-07-06 at 07:47 -0500, Jamie Strandboge wrote:
> > A security bug was reported by Jeffrey Walton against reseed in
> > Ubuntu. You are being emailed as the upstream contact. Please keep
> > oss-security@...ts.openwall.com[1] CC'd for any updates on this
> > issue.
> >
> > This issue should be considered public. A CVE is being requested;
> > please mention this in any changelogs.
> >
> > Details from the public bug follow:
> > https://launchpad.net/bugs/804594
> >
> > From the reporter:
> > "reseed(8) performs an insecure HTTP fetch of data from random.org.
> > The script is automatically executed when installed, and any time the
> > user chooses to execute. In addition, the reseed man pages do not
> > mention the data is retrieved over an insecure channel."
> >
> > As pointed out by the reporter, from the man page: "It is run once
> > during the installation of the package only". An attacker could perform
> > a MITM during package installation or whenever the reseed command is
> > run to provide predictable data for the random number seed.
> 
> While the attack is difficult to achieve (need both MITM at time of
> package installation AIUI), it seems that this still should get a CVE.
> 

I'll give the HTTP issue CVE-2011-2683.

In all seriousness though, running this on install should probably get an
ID as you can't say you have complete trust in whatever the default random
site is (in this case it's random.org).

It's probably not safe at all honestly. If you don't have entropy, HTTPS
isn't going to be secure either.

I'd rather not start a fight though by assigning a bunch of IDs for
something that is insecure by design. If you wish for more IDs, please let
me know.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.