[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CACYkhxjAjVTrEGDtcCz6Sn3E=mW4AkUsQ_om6_FNxr4zxbc8kw@mail.gmail.com>
Date: Wed, 26 Jun 2013 14:39:49 +1000
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com
Subject: Re: KDE Paste Applet
On 13 June 2013 10:02, Michael Samuel <mik@...net.net> wrote:
> Ok, so the fix for this uses KRandom::random()...
>
> I suggest leaving the KDE Paste fix as-is and replacing KRandom with
> something that just fills an integer from /dev/urandom - then we can save a
> few CVE numbers for the rest of the year.
>
> qrand() should probably also do the same, especially since cnonces for
> HTTP auth are using it - that means there's only 2^32 (at best) possible
> cnonces...
>
>>
>>
Fedora and Ubuntu have both pushed out this patch. Requesting a new CVE
for "KRandom::random() isn't a secure PRNG", since the KDE guys are
convinced that it is.
Regards,
Michael
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
