Bug 1044315 (CVE-2013-6445)

Summary:	CVE-2013-6445 cumin: weak password hashing
Product:	[Other] Security Response	Reporter:	David Jorm <djorm>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	djorm, eerlands, esammons, iboverma, jross, matt, mcressma, mjc, security-response-team, sgraf, tmckay, tnovacik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-04-28 17:14:28 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1044317, 1044318
Bug Blocks:	858767, 1059047

Description David Jorm 2013-12-18 05:25:48 UTC

It was found that cumin used the crypt(3) DES-based hash function with insufficient salt to store passwords. This hash function has known weaknesses, and an attacker who compromises the user database could use this flaw to recover plaintext passwords.

Comment 1 David Jorm 2013-12-18 05:26:40 UTC

Acknowledgements:

This issue was discovered by Tomáš Nováčik of the Red Hat MRG Quality Engineering team.

Comment 2 David Jorm 2013-12-18 05:28:06 UTC

*** Bug 1043443 has been marked as a duplicate of this bug. ***

Comment 13 Trevor McKay 2014-02-07 22:00:02 UTC

Easy to test:

1) Copy a user database from a previous version of cumin

cumin-admin export-users users

2) Verify that the password fields have no salt prefix (more users)
3) Set up the new version of cumin
4) Import the user database

cumin-admin import-users users

5) Run cumin and log in as an old user -- proves that old hashes still work

6) Use change password to set the user's password to the same value
7) Log out and log in again -- works
8) Add a brand new user

cumin-admin add-user newguy somepassword

9) Export the user db and verify that the $6 salt prefix is added in both cases

cumin-admin export-users updated_users

Comment 14 Trevor McKay 2014-02-07 22:02:38 UTC

Note, if we want a security advisory on this, uses can just be instructed to change their password the next time they log in after installation.  This will switch the hash, even if they reset to the same password.

(unless of course they're using LDAP, when it doesn't matter)

Comment 22 errata-xmlrpc 2014-04-28 16:45:12 UTC

This issue has been addressed in following products:

  MRG for RHEL-5 v. 2

Via RHSA-2014:0441 https://rhn.redhat.com/errata/RHSA-2014-0441.html

Comment 23 errata-xmlrpc 2014-04-28 16:47:27 UTC

This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2014:0440 https://rhn.redhat.com/errata/RHSA-2014-0440.html