[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 31 May 2013 10:39:38 +1000
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com
Subject: Re: KDE Paste Applet
Is anyone from KDE working on fixing this? I wrote a quick patch and
was hoping somebody from the KDE team could vet and incorporate it.
On 30 May 2013 03:58, Kurt Seifried <kseifried@...hat.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 05/28/2013 05:16 AM, Michael Samuel wrote:
>> The paste applet included with kdeplasma-addons allows you to define
>> macros that will copy some generated data into the clipboard, using
>> simple macros to define the source and format of the data.
>>
>> The available macros include %{password(...)} which generates "random"
>> passwords.
>>
>> Here is the code that generates the passwords (from pastemacroexpander.cpp):
>>
>> QDateTime now = QDateTime::currentDateTime();
>> qsrand(now.toTime_t() / now.time().msec());
>> for (int i = 0; i < charCount; ++i) {
>> result += chars[qrand() % chars.count()];
>> }
>>
>> Breaking passwords generated by this (for example from leaked password
>> hashes) can be done extremely quickly, especially if a password expiry
>> or other hint is stored with the password.
>>
>> Workaround: You can change the macro you were using to a %{exec(...)}
>> macro which calls a secure password generator. Please select your
>> replacement carefully.
>>
>> I reported this to security@....org and created a launchpad ticket
>> against the Ubuntu package on May 13, followed up with a proof of
>> concept on the 17th, and have received no response at all from either.
>> Apologies if that was the wrong contact method.
>>
>> Regards,
>> Michael
>
> Nice find. Please use CVE-2013-2120 for this issue.
>
>
> - --
> Kurt Seifried Red Hat Security Response Team (SRT)
> PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (GNU/Linux)
>
> iQIcBAEBAgAGBQJRpkHZAAoJEBYNRVNeJnmTZtcP+wdyo+6kfdJq47WO5F9csHmI
> vDMFNFRNEjEYgNeD+dQBBB1oEHf/hxi67OJ8cDjZY/x1P4nEj11s/mic1mV6yKw9
> 0BiPLorquKXRv8s/374T3Fjo4BIHEgWeaaAN0SiaqW5Kwba2t9RXt0RBDs4Lc1R2
> 1b41BgmvhvZQjxQ0jzffNlaTMntoZdg4DqJh8JQqyHcFbNwFdgjJJVkK4yBPhNYA
> 8KjBnKJrrfj9VqGy/gYw+iMn0l5FGo8IfTwmfkVJEo0V2NyBvmA0X5CFYX7HPGeK
> giKkLZuPQKdC00DSLilLgyoPw6sNKdo1aPZNta+g9fVZt45U75y4SqagsgcDn1HC
> +A3XHy9YxanXnW82PSqABBoc/VrI5H2hpKU4y60WNGseHetGAqCv6v1ucpv14++B
> Cx9PmYstESnmRGCnNDftG/rQeJlJniw59tusDlV6eJSuxZq11NPBDAhqxjTi4naY
> L4wrQZa+xjKlRcmUlfvyTf5Cxhy6gOrEcygBw8OdzEZPy7PN9LLhmK3ZlJk9i0Yu
> 0hFBUWwDSi0fnMdNlKcfjjKKa3Q5yrMz84sQDU+4trbtoJXHQMsQQJoo5CITdTUZ
> uk+L54QPZ82E9Z/0f2RbdtAj+wRPIAKE9Os9wFDd7HcY5LlfV+rMstnRCg69WY4R
> buQ4sELAjJndAVU2Kotb
> =/83d
> -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
