centos 6
crypto weakness #308

4

Weakness Breakdown


Definition:

This weakness involves creating non-standard or non-tested algorithms, using weak algorithms or applying cryptographic algorithms incorrectly. Algorithms that were once considered safe are commonly later found to be unsafe, as the algorithms were broken.

Warning code(s):

The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment.

File Name:

sudo-1.8.6p3/plugins/sudoers/auth/passwd.c

Context:

The highlighted line of code below is the trigger point of this particular Centos 6 crypto weakness.

     debug_decl(sudo_passwd_verify, SUDO_DEBUG_AUTH)

    pw_len = strlen(pw_epasswd);

#ifdef HAVE_GETAUTHUID
    /* Ultrix shadow passwords may use crypt16() */
    error = strcmp(pw_epasswd, (char *) crypt16(pass, pw_epasswd));
    if (!error)
	debug_return_int(AUTH_SUCCESS);
#endif /* HAVE_GETAUTHUID */

    /*
     * Truncate to 8 chars if standard DES since not all crypt()'s do this.
     * If this turns out not to be safe we will have to use OS #ifdef's (sigh).
     */
    sav = pass[8];
    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len))
	pass[8] = '\0';

    /*
     * Normal UN*X password check.
     * HP-UX may add aging info (separated by a ',') at the end so
     * only compare the first DESLEN characters in that case.
     */
    epass = (char *) crypt(pass, pw_epasswd);
    pass[8] = sav;
    if (HAS_AGEINFO(pw_epasswd, pw_len) && strlen(epass) == DESLEN)
	error = strncmp(pw_epasswd, epass, DESLEN);
    else
	error = strcmp(pw_epasswd, epass);

    debug_return_int(error ? AUTH_FAILURE : AUTH_SUCCESS);
}

int
sudo_passwd_cleanup(pw, auth)
    struct passwd *pw;
    sudo_auth *auth;
{
    char *pw_epasswd = auth->data;
    debug_decl(sudo_passwd_cleanup, SUDO_DEBUG_AUTH)

    if (pw_epasswd != NULL) {
	zero_bytes(pw_epasswd, strlen(pw_epasswd));
	efree(pw_epasswd);
    }
    debug_return_int(AUTH_SUCCESS);
} 

The registered trademark Linux® is used pursuant to a sublicense from the Linux Foundation, the exclusive licensee of Linus Torvalds, owner of the mark on a world­wide basis.