bugtraq - KDE Paste Applet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 28 May 2013 21:16:46 +1000
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com, bugtraq@...urityfocus.com
Subject: KDE Paste Applet

The paste applet included with kdeplasma-addons allows you to define
macros that will copy some generated data into the clipboard, using
simple macros to define the source and format of the data.

The available macros include %{password(...)} which generates "random"
passwords.

Here is the code that generates the passwords (from pastemacroexpander.cpp):

    QDateTime now = QDateTime::currentDateTime();
    qsrand(now.toTime_t() / now.time().msec());
    for (int i = 0; i < charCount; ++i) {
        result += chars[qrand() % chars.count()];
    }

Breaking passwords generated by this (for example from leaked password
hashes) can be done extremely quickly, especially if a password expiry
or other hint is stored with the password.

Workaround: You can change the macro you were using to a %{exec(...)}
macro which calls a secure password generator.  Please select your
replacement carefully.

I reported this to security@....org and created a launchpad ticket
against the Ubuntu package on May 13, followed up with a proof of
concept on the 17th, and have received no response at all from either.
 Apologies if that was the wrong contact method.

Regards,
  Michael