sm-announce AT lists.ibiblio.org

Subject: Sm-announce mailing list

List archive

[SM-Announce] SECURITY ISSUE: /etc/login.defs: passwords only recognize 8 chars

From: David Kowis <dkowis AT shlrm.org>
To: sm-discuss AT lists.ibiblio.org, sm-users AT lists.ibiblio.org, sm-announce AT lists.ibiblio.org
Subject: [SM-Announce] SECURITY ISSUE: /etc/login.defs: passwords only recognize 8 chars
Date: Fri, 20 Jan 2006 10:24:24 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello all,
The shadow spell has been installing a bogus /etc/login.defs that
doesn't have MD5_CRYPT_ENAB set.

This vulnerability affects users of ALL grimoires. PAM users, however,
shouldn't be affected, but it never hurts to check :)

There are currently two solutions:
1. Immediately fix your /etc/login.defs :
change

#MD5_CRYPT_ENAB no
to
MD5_CRYPT_ENAB yes

Note that the line is now uncommented.

OR

2: Wait until later today and "scribe update" then shadow should show up
in `sorcery queue-security`. Ensure you recast it, if you didn't choose
the first option.

Either way, enabling this requires the administrator to redo all the
passwords for the users on this box as it changes the hash that the
passwords are encrypted with.

David Kowis

ISO Team Lead - www.sourcemage.org
Source Mage GNU/Linux

Progress isn't made by early risers. It's made by lazy men trying to
find easier ways to do something.
- Robert Heinlein

Any sufficiently advanced technology is indistinguishable from magic.
- Arthur C. Clarke

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)

iD8DBQFD0Q64tgErhgxHMHsRAgGjAJ9rEb/yDk3yoBp+SBZHlZ3pUl7mLACfb+k3
yGI0F1jNSf+93RJjtvwpKvU=
=xy8J
-----END PGP SIGNATURE-----

[SM-Announce] SECURITY ISSUE: /etc/login.defs: passwords only recognize 8 chars, David Kowis, 01/20/2006
- Re: [SM-Announce] [SM-Discuss] SECURITY ISSUE: /etc/login.defs: passwords only recognize 8 chars, Arwed von Merkatz, 01/20/2006