Bug 1044315 (CVE-2013-6445) - CVE-2013-6445 cumin: weak password hashing
Summary: CVE-2013-6445 cumin: weak password hashing
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-6445
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1043443 (view as bug list)
Depends On: 1044317 1044318
Blocks: 858767 1059047
TreeView+ depends on / blocked
 
Reported: 2013-12-18 05:25 UTC by David Jorm
Modified: 2023-05-12 12:51 UTC (History)
12 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2014-04-28 17:14:28 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0440 0 normal SHIPPED_LIVE Moderate: Red Hat Enterprise MRG Grid 2.5 security, bug fix, and enhancement update 2014-04-28 20:43:37 UTC
Red Hat Product Errata RHSA-2014:0441 0 normal SHIPPED_LIVE Moderate: Red Hat Enterprise MRG Messaging 2.5 security, bug fix, and enhancement update 2014-04-28 20:43:13 UTC

Description David Jorm 2013-12-18 05:25:48 UTC
It was found that cumin used the crypt(3) DES-based hash function with insufficient salt to store passwords. This hash function has known weaknesses, and an attacker who compromises the user database could use this flaw to recover plaintext passwords.

Comment 1 David Jorm 2013-12-18 05:26:40 UTC
Acknowledgements:

This issue was discovered by Tomáš Nováčik of the Red Hat MRG Quality Engineering team.

Comment 2 David Jorm 2013-12-18 05:28:06 UTC
*** Bug 1043443 has been marked as a duplicate of this bug. ***

Comment 13 Trevor McKay 2014-02-07 22:00:02 UTC
Easy to test:

1) Copy a user database from a previous version of cumin

cumin-admin export-users users

2) Verify that the password fields have no salt prefix (more users)
3) Set up the new version of cumin
4) Import the user database

cumin-admin import-users users

5) Run cumin and log in as an old user -- proves that old hashes still work

6) Use change password to set the user's password to the same value
7) Log out and log in again -- works
8) Add a brand new user

cumin-admin add-user newguy somepassword

9) Export the user db and verify that the $6 salt prefix is added in both cases

cumin-admin export-users updated_users

Comment 14 Trevor McKay 2014-02-07 22:02:38 UTC
Note, if we want a security advisory on this, uses can just be instructed to change their password the next time they log in after installation.  This will switch the hash, even if they reset to the same password.

(unless of course they're using LDAP, when it doesn't matter)

Comment 22 errata-xmlrpc 2014-04-28 16:45:12 UTC
This issue has been addressed in following products:

  MRG for RHEL-5 v. 2

Via RHSA-2014:0441 https://rhn.redhat.com/errata/RHSA-2014-0441.html

Comment 23 errata-xmlrpc 2014-04-28 16:47:27 UTC
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2014:0440 https://rhn.redhat.com/errata/RHSA-2014-0440.html


Note You need to log in before you can comment on or make changes to this bug.