Skip to Content.
Sympa Menu

sm-announce - [SM-Announce] SECURITY ISSUE: /etc/login.defs: passwords only recognize 8 chars

sm-announce AT lists.ibiblio.org

Subject: Sm-announce mailing list

List archive

Chronological Thread  
  • From: David Kowis <dkowis AT shlrm.org>
  • To: sm-discuss AT lists.ibiblio.org, sm-users AT lists.ibiblio.org, sm-announce AT lists.ibiblio.org
  • Subject: [SM-Announce] SECURITY ISSUE: /etc/login.defs: passwords only recognize 8 chars
  • Date: Fri, 20 Jan 2006 10:24:24 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello all,
The shadow spell has been installing a bogus /etc/login.defs that
doesn't have MD5_CRYPT_ENAB set.

This vulnerability affects users of ALL grimoires. PAM users, however,
shouldn't be affected, but it never hurts to check :)

There are currently two solutions:
1. Immediately fix your /etc/login.defs :
change

#MD5_CRYPT_ENAB no
to
MD5_CRYPT_ENAB yes

Note that the line is now uncommented.

OR

2: Wait until later today and "scribe update" then shadow should show up
in `sorcery queue-security`. Ensure you recast it, if you didn't choose
the first option.

Either way, enabling this requires the administrator to redo all the
passwords for the users on this box as it changes the hash that the
passwords are encrypted with.


David Kowis

ISO Team Lead - www.sourcemage.org
Source Mage GNU/Linux

Progress isn't made by early risers. It's made by lazy men trying to
find easier ways to do something.
- Robert Heinlein

Any sufficiently advanced technology is indistinguishable from magic.
- Arthur C. Clarke

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)

iD8DBQFD0Q64tgErhgxHMHsRAgGjAJ9rEb/yDk3yoBp+SBZHlZ3pUl7mLACfb+k3
yGI0F1jNSf+93RJjtvwpKvU=
=xy8J
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page