Re: [Pam-developers] [PATCH] pam_userdb: fix password hash comparison
On So, 2014-01-25 at 03:23 +0400, Dmitry V. Levin wrote:
Starting with commit Linux-PAM-0-77-28-g0b3e583 that introduced
hashed
passwords support in pam_userdb, hashes are compared case-insensitively.
This bug leads to accepting hashes for completely different passwords in
addition to those that should be accepted.
Additionally, commit Linux-PAM-1_1_6-13-ge2a8187 that added support for
modern password hashes with different lengths and settings, did not
update the hash comparison accordingly, which leads to accepting
computed hashes longer than stored hashes when the latter is a prefix
of the former.
OK to commit.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
(You'll never know whether the road is wrong though.)