Bug 471904 – <kde-base/kdeplasma-addons-4.10.3-r1 : insecure password generator (CVE-2013-2120)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-05-31 13:27:32 UTC]

From ${URL} :

The paste applet included with kdeplasma-addons allows you to define
macros that will copy some generated data into the clipboard, using
simple macros to define the source and format of the data.

The available macros include %{password(...)} which generates "random"
passwords.

Here is the code that generates the passwords (from pastemacroexpander.cpp):

    QDateTime now = QDateTime::currentDateTime();
    qsrand(now.toTime_t() / now.time().msec());
    for (int i = 0; i < charCount; ++i) {
        result += chars[qrand() % chars.count()];
    }

Breaking passwords generated by this (for example from leaked password
hashes) can be done extremely quickly, especially if a password expiry
or other hint is stored with the password.

Workaround: You can change the macro you were using to a %{exec(...)}
macro which calls a secure password generator.  Please select your
replacement carefully.



@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.

[Comment 1 Michael Palimaka (kensington) 2013-06-04 16:49:41 UTC]

Patched in CVS. It is ready to stabilise at your convenience.

+  04 Jun 2013; Michael Palimaka <[e-mail]>
+  +files/kdeplasma-addons-4.10.3-cve-2013-2120.patch,
+  +kdeplasma-addons-4.10.3-r1.ebuild:
+  Backport patch from upstream to fix CVE-2013-2120 wrt bug #471904.

[Comment 2 Andreas K. Hüttel 2013-06-08 22:33:03 UTC]

OK let's get this fixed. Please stabilize

kde-base/kdeplasma-addons-4.10.3-r1

amd64 ppc ppc64 x86

[Comment 3 Agostino Sarubbo 2013-06-09 08:23:26 UTC]

amd64 stable

[Comment 4 Agostino Sarubbo 2013-06-09 08:23:38 UTC]

x86 stable

[Comment 5 Agostino Sarubbo 2013-06-09 08:23:48 UTC]

ppc stable

[Comment 6 Agostino Sarubbo 2013-06-09 08:23:58 UTC]

ppc64 stable

[Comment 7 Johannes Huber (RETIRED) 2013-06-09 10:43:32 UTC]

Thanks all, kde herd has nothing to do here anymore.

+  09 Jun 2013; Johannes Huber <[e-mail]> -kdeplasma-addons-4.10.3.ebuild:
+  Remove old wrt bug #471904.

[Comment 8 Michael Palimaka (kensington) 2013-06-26 06:07:09 UTC]

According to RedHat "That fix is not much better.  KRandom is just rand(), so there's only 2^32 possible seeds.".

Thoughts?

[Comment 9 Michael Palimaka (kensington) 2013-06-27 18:06:14 UTC]

(In reply to Michael Palimaka (kensington) from comment #8)
> According to RedHat "That fix is not much better.  KRandom is just rand(),
> so there's only 2^32 possible seeds.".
> 
> Thoughts?

This is now tracked in bug #474986 instead.

[Comment 10 Chris Reffett (RETIRED) 2013-09-11 15:02:58 UTC]

GLSA vote: no.

[Comment 11 Sergey Popov 2013-09-13 11:29:10 UTC]

GLSA vote: no

Closing as noglsa