136 lines
5.1 KiB
Text
136 lines
5.1 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-EN-14:11.crypt Errata Notice
|
|
The FreeBSD Project
|
|
|
|
Topic: crypt(3) default hashing algorithm
|
|
|
|
Category: core
|
|
Module: libcrypt
|
|
Announced: 2014-10-22
|
|
Affects: FreeBSD 9.3 and FreeBSD 10.0-STABLE after 2014-05-11 and
|
|
before 2014-10-16.
|
|
Corrected: 2014-10-13 15:56:47 UTC (stable/10, 10.1-PRERELEASE)
|
|
2014-10-16 21:39:04 UTC (releng/10.1, 10.1-RC3)
|
|
2014-10-16 21:39:04 UTC (releng/10.1, 10.1-RC2-p2)
|
|
2014-10-16 21:39:04 UTC (releng/10.1, 10.1-RC1-p2)
|
|
2014-10-16 21:39:04 UTC (releng/10.1, 10.1-BETA3-p2)
|
|
2014-10-21 21:09:54 UTC (stable/9, 9.3-STABLE)
|
|
2014-10-21 23:50:46 UTC (releng/9.3, 9.3-RELEASE-p4)
|
|
|
|
For general information regarding FreeBSD Errata Notices and Security
|
|
Advisories, including descriptions of the fields above, security
|
|
branches, and the following sections, please visit
|
|
<URL:http://security.freebsd.org/>.
|
|
|
|
I. Background
|
|
|
|
The crypt(3) function performs password hashing. Different algorithms
|
|
of varying strength are available, with older, weaker algorithms being
|
|
retained for compatibility.
|
|
|
|
The crypt(3) function was originally based on the DES encryption
|
|
algorithm and generated a 13-character hash from an eight-character
|
|
password (longer passwords were truncated) and a two-character salt.
|
|
|
|
II. Problem Description
|
|
|
|
In recent FreeBSD releases, the default algorithm for crypt(3) was
|
|
changed to SHA-512, which generates a much longer hash than the
|
|
traditional DES-based algorithm.
|
|
|
|
III. Impact
|
|
|
|
Many applications assume that crypt(3) always returns a traditional DES
|
|
hash, and blindly copy it into a short buffer without bounds checks. This
|
|
may lead to a variety of undesirable results including, at worst, crashing
|
|
the application.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your system to a supported FreeBSD stable or release / security
|
|
branch (releng) dated after the correction date.
|
|
|
|
2) To update your present system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch http://security.FreeBSD.org/patches/EN-14:11/crypt.patch
|
|
# fetch http://security.FreeBSD.org/patches/EN-14:11/crypt.patch.asc
|
|
# gpg --verify crypt.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:http://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
Restart all deamons using the library, or reboot the system.
|
|
|
|
3) To update your system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/9/ r273425
|
|
releng/9.3/ r273438
|
|
stable/10/ r273043
|
|
releng/10.1/ r273187
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
The latest revision of this Errata Notice is available at
|
|
http://security.FreeBSD.org/advisories/FreeBSD-EN-14:11.crypt.asc
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.0
|
|
|
|
iQIcBAEBCgAGBQJUSAvTAAoJEO1n7NZdz2rnOnsP/0a4Cz7DAc9aW7Ia1aLnGBbZ
|
|
HDBF7t+LjVj94PnXxhUWWxGgN5KAsYg1TaXw2b68KyrQYQK/X9mG6Qlu8MWjngaL
|
|
fH3bKPV+h2Fog8Y7nEW0QmW5sd863Uo5NxNyDcXU0m4frk7yo+i6yBHlBq07eWGv
|
|
6fqDjLiP8+kLLCkDtu+s4e9NfJcc8XMRxCzEseLVorDU/5eZWUx5Mb5NkJWt6vLf
|
|
jrPclEEVZrrfsf5zt6MN6ZmwYi85RcW/TwksCT5UzYQeoZlr3BtTsFMqEs8ZYulJ
|
|
1kUcml4yV8IstaWm1bq8QMM76zfUHe/OzLbwTcynZofBPSWS4DF1f+GpzHW7z11w
|
|
/bNGLFWdXm+mbLjv6GCi/rpplIuTUgdTCUr0yC9iyox9e1a1Ukl6B63PA/nnwzas
|
|
OFAKZppMiP8S4/RtyueeBJx+ZASNn+ZPTjiiiV92VxYzIreLYDbClzMFjVqd95Wc
|
|
Yt1AYvfeRAPmTLNEGhGbgOKZBX6ZdCZDqQIctvnT/LjmJQ3evSxz+wVge1UnYMit
|
|
do71bHIWLrRPZlyyh/bNHT2pXxj2Sdw49rbiJqE7VeJnbo1qlAv5jjxaKF8rs+WZ
|
|
hFINgZaoVQ2HdHXgj/dvnKi/D7QrfVBomyRMrYq8YmoniRhu1uqbT2LN8QjMhOnA
|
|
MfV6XkrYkUgh3Z74uRyu
|
|
=psMc
|
|
-----END PGP SIGNATURE-----
|