File _patchinfo of Package patchinfo.import5028

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.import5028

<patchinfo incident="yast2-core" version="5028">
  <issue tracker="bnc" id="700876" />
  <issue tracker="CVE" id="CVE-2011-2483" />
  <category>security</category>
  <rating>low</rating>
  <summary>yast2-core: Adjust to fix crypt_blowfish 8-bit character mishandling</summary>
  <description>This update contains yast2 core changes to change the hash
generation of new passwords to the new secure style.

Please read the general notes below:

The implementation of the blowfish based password hashing
method had a bug affecting passwords that contain 8bit
characters (e.g. umlauts).  Affected passwords are
potentially faster to crack via brute force methods
(CVE-2011-2483).

SUSE's crypt() implementation supports the blowfish
password hashing function (id $2a) and system logins by
default also use this method. This update eliminates the
bug in the $2a implementation. After installing the update
existing $2a hashes therefore no longer match hashes
generated with the new, correct implementation if the
password contains 8bit characters. For system logins via
PAM the pam_unix2 module activates a compat mode and keeps
processing existing $2a hashes with the old algorithm. This
ensures no user gets locked out. New passwords hashes are
created with the id &quot;$2y&quot; to unambiguously identify them as
generated with the correct implementation.

Note: To actually migrate hashes to the new algorithm all
users are advised to change passwords after the update.

Services that do not use PAM but do use crypt() to store
passwords using the blowfish hash do not have such a compat
mode. That means users with 8bit passwords that use such
services will not be able to log in anymore after the
update. As workaround administrators may edit the service's
password database and change stored hashes from $2a to $2x.
This will result in crypt() using the old algorithm. Users
should be required to change their passwords to make sure
they are migrated to the correct algorithm.

FAQ:

Q: I only use ASCII characters in passwords, am I a
affected in any way? A: No.

Q: What's the meaning of the ids before and after the
update? A: Before the update: $2a -&gt; buggy algorithm

After the update: $2x -&gt; buggy algorithm $2a -&gt; correct
algorithm $2y -&gt; correct algorithm

System logins using PAM have a compat mode enabled by
default: $2x -&gt; buggy algorithm $2a -&gt; buggy algorithm $2y
-&gt; correct algorithm

Q: How do I require users to change their password on next
login? A: Run the following command as root for each user:
chage -d 0 &lt;username&gt;

Q: I run an application that has $2a hashes in it's
password database. Some users complain that they can not
log in anymore. A: Edit the password database and change
the &quot;$2a&quot; prefix of the affected users' hashes to &quot;$2x&quot;.
They will be able to log in again but should change their
password ASAP.

Q: How do I turn off the compat mode for system logins? A:
Set BLOWFISH_2a2x=no in /etc/default/passwd
</description>
  <packager>adrianSuSE</packager>
</patchinfo>

Places

File _patchinfo of Package patchinfo.import5028

Places