minor apache htpasswd problem
From: Andreas Steinmetz (ast_at_domdv.de)
Date: 09/25/03
- Previous message: bugtraq_at_hackerfactor.com: "ICMP pokes holes in firewalls..."
- Next in thread: p_at_phk.at: "Re: minor apache htpasswd problem"
- Reply: p_at_phk.at: "Re: minor apache htpasswd problem"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 25 Sep 2003 22:25:05 +0200 To: bugtraq@securityfocus.com
This is valid for the htpasswd utility of at least apache 1.3.27 and 1.3.28:
The salt used for password generation solely depends on the current
system time:
(void) srand((int) time((time_t *) NULL));
ap_to64(&salt[0], rand(), 8);
This causes all passwords generated within the same second to have the
same salt value. This in turn may cause auto-generated default passwords
to have the same value which could be a point of attack if the password
file is not properly protected.
The apache team was notified on 23.08.2003 but didn't respond.
Though it would need quite some administrative errors before the above
could be used it should still be corrected.
-- Andreas Steinmetz
- Previous message: bugtraq_at_hackerfactor.com: "ICMP pokes holes in firewalls..."
- Next in thread: p_at_phk.at: "Re: minor apache htpasswd problem"
- Reply: p_at_phk.at: "Re: minor apache htpasswd problem"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
