Date: Mon, 26 Jul 2004 14:20:26 GMT From: Ceri Davies <ceri@submonkey.net> To: freebsd-bugs@FreeBSD.org Subject: [tradigan@newrevolutions.net: RE: misc/69596: When logging in or su'ing to root, I noticed that if you type the correct password but add characters to the end of the correct password, the password still passes validation and allows you to login]Reply-To: Ceri Davies <ceri@submonkey.net> Message-ID: <200407261420.i6QEKQvk058634@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR misc/69596; it has been noted by GNATS. From: Ceri Davies <ceri@submonkey.net> To: FreeBSD Gnats Submit <freebsd-gnats-submit@FreeBSD.org> Cc: Subject: [tradigan@newrevolutions.net: RE: misc/69596: When logging in or su'ing to root, I noticed that if you type the correct password but add characters to the end of the correct password, the password still passes validation and allows you to login]Date: Mon, 26 Jul 2004 15:11:32 +0100 Message-ID: <20040726141132.GE24947@submonkey.net> Mail-Followup-To: Ceri Davies <ceri@submonkey.net>, FreeBSD Gnats Submit <freebsd-gnats-submit@FreeBSD.org> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="hxkXGo8AKqTJ+9QI" Content-Disposition: inline X-PGP: finger ceri@FreeBSD.org User-Agent: Mutt/1.5.6i Sender: Ceri Davies <setantae@submonkey.net> --hxkXGo8AKqTJ+9QI Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Adding to audit trail. --hxkXGo8AKqTJ+9QI Content-Type: message/rfc822 Content-Disposition: inline Return-path: <tradigan@newrevolutions.net> Envelope-to: ceri@submonkey.net Delivery-date: Mon, 26 Jul 2004 13:50:21 +0100 Received: from ns1.flncs.com ([204.0.142.254] helo=beastie.flncs.com) by shrike.submonkey.net with smtp (Exim 4.41 (FreeBSD)) id 1Bp4vn-0002FE-82 for ceri@submonkey.net; Mon, 26 Jul 2004 13:50:21 +0100 Received: (qmail 26593 invoked by uid 89); 26 Jul 2004 11:55:01 -0000 Received: from h-66-166-153-84.phlapafg.covad.net (HELO l03ptradigan) (tradigan@newrevolutions.net@66.166.153.84) by beastie.flncs.com with SMTP; 26 Jul 2004 11:55:01 -0000 From: "Timothy Radigan" <tradigan@newrevolutions.net> To: "Ceri Davies" <ceri@submonkey.net> Subject: RE: misc/69596: When logging in or su'ing to root, I noticed that if you type the correct password but add characters to the end of the correct password, the password still passes validation and allows you to login Date: Mon, 26 Jul 2004 08:50:06 -0400 Message-ID: <ALEJJLKJDNFOODLHIENAOEDHCAAA.tradigan@newrevolutions.net> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) In-Reply-To: <20040726121455.GD24947@submonkey.net> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on shrike.private.submonkey.net X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.63 Indeed. Man I feel dumb. I didn't even put the two together. Thanks for bringing that to my attention. -----Original Message----- From: Ceri Davies [mailto:setantae@submonkey.net]On Behalf Of Ceri Davies Sent: Monday, July 26, 2004 8:15 AM To: Timothy Radigan Cc: freebsd-gnats-submit@FreeBSD.org Subject: Re: misc/69596: When logging in or su'ing to root, I noticed that if you type the correct password but add characters to the end of the correct password, the password still passes validation and allows you to login On Sun, Jul 25, 2004 at 11:01:06PM +0000, Timothy Radigan wrote: > Log in using an account, type the correct password and a few extra > characters after the correct password and try to log in. You will > be validated and access is granted. At a guess, I'd say that you are using DES encrypted passwords, and your password (after appending the extra characters) is more than 8 characters long. This is a common limitation with DES. Ceri -- It is not tinfoil, it is my new skin. I am a robot. --hxkXGo8AKqTJ+9QI--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200407261420.i6QEKQvk058634>