Date: Fri, 24 May 2013 14:43:29 -0700 From: Seth Arnold <seth.arnold@...onical.com> To: coley@...us.mitre.org Cc: oss-security@...ts.openwall.com, security@...ntu.com Subject: CVE Request: pwgen Hello Kurt, Steve, all, Do these issues deserve CVE numbers? A user reported to launchpad  that pwgen will use /dev/urandom or /dev/random if it can, but will silently fall back to using drand48() or random() if the device files fail to open. The report also mentions that when the device files are available, the output is biased by too-simple use of the modulo operator to scale the output to 0 <= n < max. There are further complaints about the poor use of available entropy when seeding the weaker algorithms. A potentially related complaint is in Debian's BTS : in this bug report, the user wanted a way to force use of /dev/random even if /dev/urandom is available. I've pasted the relevant source to pastebin.ubuntu.com . Are any of these worthy of a CVE number? - silent fall-back to weak algorithms - biased output due to poor use of modulo operations - poor seeding of weak algorithms Thank you 1: https://bugs.launchpad.net/ubuntu/+source/pwgen/+bug/1183213 2: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=672241 3: http://pastebin.ubuntu.com/5698361/ Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.