patchTiger UNIX security tool - Patches: patch #7675, Fixes for hashing algorithm...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

patch #7675: Fixes for hashing algorithm detection

Submitted by:  pyllyukko <pyllyukko>
Submitted on:  Wed 23 Nov 2011 08:04:43 PM UTC  
 
Category: Security testPriority: 5 - Normal
Status: NonePrivacy: Public
Assigned to: NoneOpen/Closed: Open

Wed 23 Nov 2011 08:04:43 PM UTC, original submission:

Timo's SHA-512 patch (#7186) didn't work for me. There's a few problems when dealing with SHA hashes in the shadow file. First, the length of the salt varies, at least on my box with shadow suite 4.1.4.3 the length is randomized.

We can see it in libmisc/salt.c:
/*

  • Return the salt size.
  • The size of the salt string is between 8 and 16 bytes for the SHA crypt
  • methods.

*/

And I can confirm this by running something like the following on my box:
awk -F'$' '/\$6/{print length($4)}' /etc/shadow

The string in shadow might also include the "rounds syntax", when you have modified the SHA_CRYPT_(MIN|MAX)_ROUNDS in login.defs. The hash strings migtht look like this: "$6$rounds=<integer>$<salt>$<hash>".

That's why it's hard to write a precise pattern in Bash, at least with case, when you can't use regular expressions. When the hashing algorithm is not properly detected, Tiger might give you false positives such as pass014w (it thinks the account is locked/disabled when it isn't) and false negative for pass013w.

So here is my suggestion to fix this, a generic matching for only the hashing algorithm id. I also included few missing algorithms from man 3 crypt and one more string to indicate locked account, even though it's catched by the asterisk.

pyllyukko <pyllyukko>

 

Attached Files
file #24437:  zappasswd-3.2.3.patch added by pyllyukko (1kB - text/x-diff)
file #24438:  zappasswd.patch added by pyllyukko (3kB - text/x-diff)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by pyllyukko (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 23 Nov 2011 08:04:43 PM UTCpyllyukkoAttached File-=>Added zappasswd-3.2.3.patch, #24437
      Attached File-=>Added zappasswd.patch, #24438

    Back to the top


    Powered by Savane 3.1-cleanup