exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

KDE Paste Applet Weak Password Generation

KDE Paste Applet Weak Password Generation
Posted May 28, 2013
Authored by Michael Samuel

Password generation in the KDE paste applet is not truly random.

tags | advisory, info disclosure
advisories | CVE-2013-2120
SHA-256 | 48318ab20552dce981107a3b49148a6e35dad5d6b34196e4735021f09ddb4fbb

KDE Paste Applet Weak Password Generation

Change Mirror Download
The paste applet included with kdeplasma-addons allows you to define
macros that will copy some generated data into the clipboard, using
simple macros to define the source and format of the data.

The available macros include %{password(...)} which generates "random"
passwords.

Here is the code that generates the passwords (from pastemacroexpander.cpp):

QDateTime now = QDateTime::currentDateTime();
qsrand(now.toTime_t() / now.time().msec());
for (int i = 0; i < charCount; ++i) {
result += chars[qrand() % chars.count()];
}

Breaking passwords generated by this (for example from leaked password
hashes) can be done extremely quickly, especially if a password expiry
or other hint is stored with the password.

Workaround: You can change the macro you were using to a %{exec(...)}
macro which calls a secure password generator. Please select your
replacement carefully.

I reported this to security@kde.org and created a launchpad ticket
against the Ubuntu package on May 13, followed up with a proof of
concept on the 17th, and have received no response at all from either.
Apologies if that was the wrong contact method.

Regards,
Michael
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close