|
OpenBSD: Xlockmore vulnerability |
|
|
|
Posted by LinuxSecurity.com Team
|
xlockmore has a localhost attack against it which allows recovery of the encrypted hash of the root password.
xlockmore has a localhost attack against it which allows recovery of the encrypted hash of the root password. The damage to systems using DES passwords from this attack is pretty heavy, but to systems with a well-chosen root password under blowfish encoding (see crypt(3)) the impact is much reduced. (Aside: We do not consider this a localhost root hole in the default install, since we have not seen a fast blowfish cracker yet ;-)A source code patch which remedies this problem is available at: ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.6/common/022_xlockmore.patch
|
