From owner-freebsd-hackers Sat Dec 14 03:35:10 1996 Return-Path: Received: (from root@localhost) by freefall.freebsd.org (8.8.4/8.8.4) id DAA22991 for hackers-outgoing; Sat, 14 Dec 1996 03:35:10 -0800 (PST) Received: from irz401.inf.tu-dresden.de (irz401.inf.tu-dresden.de [141.76.1.12]) by freefall.freebsd.org (8.8.4/8.8.4) with SMTP id DAA22969; Sat, 14 Dec 1996 03:35:01 -0800 (PST) Received: from sax.sax.de (sax.sax.de [193.175.26.33]) by irz401.inf.tu-dresden.de (8.6.12/8.6.12-s1) with ESMTP id MAA02833; Sat, 14 Dec 1996 12:34:42 +0100 Received: (from uucp@localhost) by sax.sax.de (8.6.12/8.6.12-s1) with UUCP id MAA02701; Sat, 14 Dec 1996 12:33:25 +0100 Received: (from j@localhost) by uriah.heep.sax.de (8.8.2/8.6.9) id MAA25325; Sat, 14 Dec 1996 12:31:37 +0100 (MET) From: J Wunsch Message-Id: <199612141131.MAA25325@uriah.heep.sax.de> Subject: Re: vulnerability in new pw suite To: proff@iq.org (Julian Assange) Date: Sat, 14 Dec 1996 12:31:37 +0100 (MET) Cc: security@freebsd.org, hackers@freebsd.org Reply-To: joerg_wunsch@uriah.heep.sax.de (Joerg Wunsch) In-Reply-To: <199612140135.MAA04639@profane.iq.org> from Julian Assange at "Dec 14, 96 12:35:25 pm" X-Phone: +49-351-2012 669 X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E X-Mailer: ELM [version 2.4ME+ PL17 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-hackers@freebsd.org X-Loop: FreeBSD.org Precedence: bulk As Julian Assange wrote: > The FreeBSD account administration pw suite is able to produce > "random" passwords for new accounts. Due to the simplicity of the > password generation algorithm involved, the passwords are easily > predictable amid a particular range of possibilities. This range > may be very narrow, depending on what sort of information is > available to the attacker. Is there any particular reason why you didn't submit this to the author in the first place? (Forwarded to David now.) -- cheers, J"org joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE Never trust an operating system you don't have sources for. ;-)