Date: Thu, 14 Jun 2018 23:46:38 +0200 From: Marcus Brinkmann <marcus.brinkmann@...r-uni-bochum.de> To: oss-security@...ts.openwall.com Subject: CVE-2018-12356 Breaking signature verification in pass (Simple Password Store) This is the third (and for now last) in my series of GnuPG signature spoof exploits. First, a cautious note: In the course of my 2 week investigation, I went through a lot of applications using gpg. There were a couple of "near misses" in critical infrastructure projects which were not vulnerable, but where I am not sure if that was due to conscious design choices or just by pure chance. It would be prudent for everybody who knows a script or package using gpg to have a look for issues with status-fd, regular expressions and/or "gpg -d | some-other-program" patterns. Now, the details about CVE-2018-12356: I found a critical vulnerability in pass, the Simple Password Store: CVE-2018-12356: An issue was discovered in password-store.sh in pass in Simple Password Store 1.7 through 1.7.1. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extensions scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution. I am also calling out the missing integrity protection in pass for password files, making pass users potentially vulnerable to a broad range of attacks. https://neopg.io/blog/pass-signature-spoof/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.