Bug 1044315 – CVE-2013-6445 cumin: weak password hashing

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1044315 - (CVE-2013-6445) CVE-2013-6445 cumin: weak password hashing

Summary:	CVE-2013-6445 cumin: weak password hashing

Status:	CLOSED ERRATA

Aliases:	CVE-2013-6445

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140428,repor...
Keywords:	Security

Duplicates:	1043443 (view as bug list)
Depends On:	1044317 1044318
Blocks:	858767 1059047
	Show dependency tree / graph

Reported:	2013-12-18 00:25 EST by David Jorm
Modified:	2014-10-20 20:05 EDT (History)
CC List:	12 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-04-28 13:14:28 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:0440	normal	SHIPPED_LIVE	Moderate: Red Hat Enterprise MRG Grid 2.5 security, bug fix, and enhancement update	2014-04-28 16:43:37 EDT
Red Hat Product Errata	RHSA-2014:0441	normal	SHIPPED_LIVE	Moderate: Red Hat Enterprise MRG Messaging 2.5 security, bug fix, and enhancement update	2014-04-28 16:43:13 EDT

Groups: None (edit)

Description David Jorm 2013-12-18 00:25:48 EST

It was found that cumin used the crypt(3) DES-based hash function with insufficient salt to store passwords. This hash function has known weaknesses, and an attacker who compromises the user database could use this flaw to recover plaintext passwords.

Comment 1 David Jorm 2013-12-18 00:26:40 EST

Acknowledgements:

This issue was discovered by Tomáš Nováčik of the Red Hat MRG Quality Engineering team.

Comment 2 David Jorm 2013-12-18 00:28:06 EST

*** Bug 1043443 has been marked as a duplicate of this bug. ***

Comment 13 Trevor McKay 2014-02-07 17:00:02 EST

Easy to test:

1) Copy a user database from a previous version of cumin

cumin-admin export-users users

2) Verify that the password fields have no salt prefix (more users)
3) Set up the new version of cumin
4) Import the user database

cumin-admin import-users users

5) Run cumin and log in as an old user -- proves that old hashes still work

6) Use change password to set the user's password to the same value
7) Log out and log in again -- works
8) Add a brand new user

cumin-admin add-user newguy somepassword

9) Export the user db and verify that the $6 salt prefix is added in both cases

cumin-admin export-users updated_users

Comment 14 Trevor McKay 2014-02-07 17:02:38 EST

Note, if we want a security advisory on this, uses can just be instructed to change their password the next time they log in after installation.  This will switch the hash, even if they reset to the same password.

(unless of course they're using LDAP, when it doesn't matter)

Comment 22 errata-xmlrpc 2014-04-28 12:45:12 EDT

This issue has been addressed in following products:

  MRG for RHEL-5 v. 2

Via RHSA-2014:0441 https://rhn.redhat.com/errata/RHSA-2014-0441.html

Comment 23 errata-xmlrpc 2014-04-28 12:47:27 EDT

This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2014:0440 https://rhn.redhat.com/errata/RHSA-2014-0440.html

Note You need to log in before you can comment on or make changes to this bug.