[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openbsd-bugs
Subject:    library/1336: Unexpect blowfish crypt behavior
From:       cjc5 () po ! cwru ! edu
Date:       2000-07-29 1:00:18
[Download RAW message or body]


>Number:         1336
>Category:       library
>Synopsis:       crypt remembers previous values of the setting
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 28 19:10:02 MDT 2000
>Last-Modified:
>Originator:     Craig J Copi
>Organization:
net
>Release:        
>Environment:
	
	System      : OpenBSD 2.6 (and 2.7)
	Architecture: OpenBSD.i386
	Machine     : i386
>Description:
	
This behavior was discovered while hunting a bug in php where 
blowfish passwords failed to crypt correctly.  This is due to the 
fact that only 17 characters of the setting are passed to the 
crypt routine.  The behavior shown by the following program was 
unexpected by me.

Compile and run the following program:
#include <stdio.h>
#include <string.h>
#include <unistd.h>
int main (void) {
  char *pwd="testtesttesttest";
  char *crypted="$2a$07$XRys.kixNfRTWuxNxKrrROOsCgOsdjjKIFtzZB49aybSBJGUV./Ky";
  char scrypted[8];
  scrypted[7] = '\0';
  strncpy (scrypted, crypted, 7);
  printf ("%s\n", crypted);
  printf ("%s\n", crypt (pwd, scrypted));
  printf ("%s\n", crypt (pwd, crypted));
  printf ("%s\n", crypt (pwd, scrypted));
  return 0;
}

When run the first call to crypt doesn't generate *crypted since we have
truncated the setting, however the third does.  The crypt function
must be storing the setting in a static buffer that doesn't get
zeroed between calls.  I did not expect the third crypt to work.  I
do not know if there are any security ramifications of this.

>How-To-Repeat:
	
Compile and run the above code.

>Fix:
	
Zero pad the setting in crypt, complain if the setting is too short,
...?  I'm not sure if this needs fixing.

>Audit-Trail:
>Unformatted:

[prev in list] [next in list] [prev in thread] [next in thread]