From sakamoto@sandbag.hlla.is.tsukuba.ac.jp  Fri Nov  1 02:54:08 2002
Return-Path: <sakamoto@sandbag.hlla.is.tsukuba.ac.jp>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 0310E37B401
	for <FreeBSD-gnats-submit@freebsd.org>; Fri,  1 Nov 2002 02:54:08 -0800 (PST)
Received: from sandbag.hlla.is.tsukuba.ac.jp (sandbag.hlla.is.tsukuba.ac.jp [130.158.85.142])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6062E43E75
	for <FreeBSD-gnats-submit@freebsd.org>; Fri,  1 Nov 2002 02:54:07 -0800 (PST)
	(envelope-from sakamoto@sandbag.hlla.is.tsukuba.ac.jp)
Received: from sandbag.hlla.is.tsukuba.ac.jp (localhost [127.0.0.1])
	by sandbag.hlla.is.tsukuba.ac.jp (8.12.6/8.12.6) with ESMTP id gA1AvEt0043775;
	Fri, 1 Nov 2002 19:57:14 +0900 (JST)
	(envelope-from sakamoto@sandbag.hlla.is.tsukuba.ac.jp)
Received: (from root@localhost)
	by sandbag.hlla.is.tsukuba.ac.jp (8.12.6/8.12.6/Submit) id gA1AvDmY043774;
	Fri, 1 Nov 2002 19:57:13 +0900 (JST)
Message-Id: <200211011057.gA1AvDmY043774@sandbag.hlla.is.tsukuba.ac.jp>
Date: Fri, 1 Nov 2002 19:57:13 +0900 (JST)
From: Hideki SAKAMOTO <sakamoto@hlla.is.tsukuba.ac.jp>
Reply-To: Hideki SAKAMOTO <sakamoto@hlla.is.tsukuba.ac.jp>
To: FreeBSD-gnats-submit@freebsd.org
Cc: sakamoto@hlla.is.tsukuba.ac.jp
Subject: opiepasswd makes bad seed for existing user
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         44808
>Category:       bin
>Synopsis:       [patch] opiepasswd(1) makes bad seed for existing user
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Nov 01 03:00:07 PST 2002
>Closed-Date:    Sat May 31 17:39:17 UTC 2008
>Last-Modified:  Sat May 31 17:39:17 UTC 2008
>Originator:     Hideki SAKAMOTO
>Release:        FreeBSD 4.7-RELEASE-p1 i386
>Organization:
>Environment:
System: FreeBSD xxxxxxxx 4.7-RELEASE-p1 FreeBSD 4.7-RELEASE-p1 #1: Fri Oct 25 16:54:58 JST 2002 sakamoto@xxxxxxxx:/usr/obj/usr/src/sys/XXXXXXXX i386


	
>Description:
	
Opienewseed() function has two problem.

1. It will chomp two digit at the end of the seed.
2. If the current seed hasn't ended in digits, "opiepasswd" without new seed
   will have attached the '1' at the end of the seed.

After these problem was fixed, I found another problem;

3. If seed's digit have consisted of '9's, these digits will have
   replaced '1'(just one character).

>How-To-Repeat:
	
Repeat opiepasswd command.

    % opiepasswd -c
    Adding sakamoto:
    Only use this method from the console; NEVER from remote. If you are using
    telnet, xterm, or a dial-in, type ^C now or exit with no password.
    Then run opiepasswd without the -c parameter.
    Using MD5 to compute responses.
    Enter new secret pass phrase: 
    Again new secret pass phrase: 

 => ID sakamoto OTP key is 499 pu9478 <=
    XXXX XXX XXXX XXX XXXX XXX

    % opiepasswd -c
    Updating sakamoto:
    Only use this method from the console; NEVER from remote. If you are using
    telnet, xterm, or a dial-in, type ^C now or exit with no password.
    Then run opiepasswd without the -c parameter.
    Using MD5 to compute responses.
    Enter old secret pass phrase: 
    Enter new secret pass phrase: 
    Again new secret pass phrase: 

 => ID sakamoto OTP key is 499 pu94 <=
    XXX XXXX XXX XXXX XXX XXXX

    % opiepasswd -c
    Updating sakamoto:
    Only use this method from the console; NEVER from remote. If you are using
    telnet, xterm, or a dial-in, type ^C now or exit with no password.
    Then run opiepasswd without the -c parameter.
    Using MD5 to compute responses.
    Enter old secret pass phrase: 
    Enter new secret pass phrase: 
    Again new secret pass phrase: 

 => ID sakamoto OTP key is 499 pu <=
    XXX XXXX XXX XXXX XXX XXXX

    % opiepasswd -c
    Updating sakamoto:
    Only use this method from the console; NEVER from remote. If you are using
    telnet, xterm, or a dial-in, type ^C now or exit with no password.
    Then run opiepasswd without the -c parameter.
    Using MD5 to compute responses.
    Enter old secret pass phrase: 
    Enter new secret pass phrase: 
    Again new secret pass phrase: 

 => ID sakamoto OTP key is 499 pu1 <=
    XXX XXXX XXX XXXX XXX XXXX

    % opiepasswd -c
    Updating sakamoto:
 !! You must use a different seed for the new OTP sequence. !!

>Fix:
Apply this patch.

*** /usr/src/contrib/opie/libopie/newseed.c.orig	Fri Nov  1 18:35:56 2002
--- /usr/src/contrib/opie/libopie/newseed.c	Fri Nov  1 18:51:29 2002
***************
*** 54,65 ****
  			max *= 10;
  
  		if ((i = strtoul(++c, (char **)0, 10)) < max) {
! 			if (++i >= max)
! 				i = 1;
! 
! 			snprintf(c, end - c, "%d", i);
! 			seed[OPIE_SEED_MAX] = 0;
! 			return 0;
  		}
  	}
  
--- 54,64 ----
  			max *= 10;
  
  		if ((i = strtoul(++c, (char **)0, 10)) < max) {
! 			if (++i < max) {
! 				snprintf(c, end - c + 2, "%d", i);
! 				seed[OPIE_SEED_MAX] = 0;
! 				return 0;
! 			}
  		}
  	}
  
	


>Release-Note:
>Audit-Trail:

From: Alan Amesbury <aka-CHKE7RJUQGNmU-freebsd.com@mailswitch.net>
To: freebsd-gnats-submit@FreeBSD.org
Cc: sakamoto@hlla.is.tsukuba.ac.jp
Subject: Re: bin/44808: opiepasswd makes bad seed for existing user
Date: Mon, 9 Jun 2003 01:32:38 -0500

 This behaviour is also present in 4.8-RELEASE.  Hideki Sakamoto's patch
 seems to correct the behaviour, though.  (It wouldn't apply cleanly,
 possibly due to minor formatting differences in the source files or
 something.  Easily corrected, though.)  This is a severe bug for those
 of us who use OPIE.
 
 I'm curious why newseed.c seems to build its value based on the previous
 seed.  It would seem to make more sense to use random(3) (not rand(3)!)
 and verify that 1) the new value doesn't equal the old, and 2) the seed
 size conforms with OPIE's seed size requirements.  I'd write such
 functionality, but I'm a bit out of my depth when it comes to serious
 crypto.
 
 In case it's needed, the exact patch applied against the newseed.c in
 4.8-RELEASE is:
 
 ---------- Patch for newseed.c ----------
 *** newseed.c.orig	Mon Jul 15 09:48:47 2002
 --- newseed.c	Mon Jun  9 01:13:25 2003
 ***************
 *** 54,65 ****
   			max *= 10;
   
   		if ((i = strtoul(++c, (char **)0, 10)) < max) {
 ! 			if (++i >= max)
 ! 				i = 1;
 ! 
 ! 			snprintf(c, end - c, "%d", i);
 ! 			seed[OPIE_SEED_MAX] = 0;
 ! 			return 0;
   		}
   	}
   
 --- 54,64 ----
   			max *= 10;
   
   		if ((i = strtoul(++c, (char **)0, 10)) < max) {
 ! 			if (++i < max) {
 ! 				snprintf(c, end - c + 2, "%d", i);
 ! 				seed[OPIE_SEED_MAX] = 0;
 ! 				return 0;
 ! 			}
   		}
   	}
   
 -------- End patch for newseed.c --------
 
 
 Again, I take no credit for it... and thanks to Hideki for coming up
 with it in the first place!
 
 
 -- 
 Alan Amesbury
 
            -  -  -  "Deep Thoughts," by Jack Handey  -  -  -
 You know something that would really make me applaud? A guy gets stuck in
 quicksand, then sinks, then suddenly comes shooting out, riding on water
 skis! How do they do that?!

From: Mikhail Teterin <mi+mx@aldan.algebra.com>
To: bug-followup@freebsd.org, sakamoto@hlla.is.tsukuba.ac.jp, des@freebsd.org
Cc:  
Subject: bin/44808: is this still a problem?
Date: Mon, 17 Jul 2006 17:04:14 -0400

 Hello!
 
 It looks like des modified this part of newseed.c in 2003, although 
 differently from the initiator's patch.
 
 	http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/44808
 
 Can the PR be closed? Thanks!
 
 	-mi

From: des@des.no (Dag-Erling =?iso-8859-1?Q?Sm=F8rgrav?=)
To: Mikhail Teterin <mi+mx@aldan.algebra.com>
Cc: bug-followup@freebsd.org,  sakamoto@hlla.is.tsukuba.ac.jp
Subject: Re: bin/44808: is this still a problem?
Date: Mon, 17 Jul 2006 23:37:27 +0200

 Mikhail Teterin <mi+mx@aldan.algebra.com> writes:
 > Can the PR be closed? Thanks!
 
 I'd say yes, unless the originator objects within a reasonable time.
 
 DES
 --=20
 Dag-Erling Sm=F8rgrav - des@des.no
State-Changed-From-To: open->closed 
State-Changed-By: gavin 
State-Changed-When: Sat May 31 17:38:16 UTC 2008 
State-Changed-Why:  
Feedback timeout (2 years). 
Originator didn't object within a reasonable time... 

http://www.freebsd.org/cgi/query-pr.cgi?pr=44808 
>Unformatted:
