[Pam-developers] [PATCH] pam_userdb: fix password hash comparison

Tomas Mraz tmraz at redhat.com
Mon Jan 27 09:37:02 UTC 2014


On So, 2014-01-25 at 03:23 +0400, Dmitry V. Levin wrote:
> Starting with commit Linux-PAM-0-77-28-g0b3e583 that introduced hashed
> passwords support in pam_userdb, hashes are compared case-insensitively.
> This bug leads to accepting hashes for completely different passwords in
> addition to those that should be accepted.
> 
> Additionally, commit Linux-PAM-1_1_6-13-ge2a8187 that added support for
> modern password hashes with different lengths and settings, did not
> update the hash comparison accordingly, which leads to accepting
> computed hashes longer than stored hashes when the latter is a prefix
> of the former.

OK to commit.
-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb
(You'll never know whether the road is wrong though.)



More information about the Pam-developers mailing list