https://bugzilla.novell.com/show_bug.cgi?id=852224 https://bugzilla.novell.com/show_bug.cgi?id=852224#c Andreas Stieger changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium Status|NEW |ASSIGNED AssignedTo|bnc-team-screening@forge.pr |Andreas.Stieger@gmx.de |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=852224 https://bugzilla.novell.com/show_bug.cgi?id=852224#c2 --- Comment #2 from Bernhard Wiedemann 2013-11-26 00:00:19 CET --- This is an autogenerated message for OBS integration: This bug (852224) was mentioned in https://build.opensuse.org/request/show/208353 Factory / xtrabackup -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=852224 https://bugzilla.novell.com/show_bug.cgi?id=852224#c4 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED CC| |meissner@suse.com InfoProvider|security-team@suse.de | Summary|Percona XtraBackup 2.1.6 |VUL-0: CVE-2013-6394: |maintenance release |Percona XtraBackup 2.1.6 | |maintenance release --- Comment #4 from Marcus Meissner 2013-11-27 08:16:43 UTC --- CVE-2013-6394 discussion on oss-security ongoing if IV fix is sufficiently random. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=852224 https://bugzilla.novell.com/show_bug.cgi?id=852224#c5 --- Comment #5 from Marcus Meissner 2013-11-30 10:08:38 UTC --- Is suppose this is part of the fix. +void +xb_crypt_init_iv() +{ + uint seed = time(NULL); + srandom(seed); +} + +void +xb_crypt_create_iv(void* ivbuf, size_t ivlen) +{ + size_t i; + ulong rndval; + + for (i = 0; i < ivlen; i++) { + if (i % 4 == 0) { + rndval = (ulong) random(); + } + ((uchar*)ivbuf)[i] = ((uchar*)&rndval)[i % 4]; + } +} This still risks keystream reuse because time() is fairly coarse. What's worse, on 64-bit big-endian architectures, it results in a constant zero IV because RAND_MAX is not large enough to reach the upper 32 bits in the first four bytes of the rndval variable. -- Florian Weimer / Red Hat Product Security Team -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=852224 https://bugzilla.novell.com/show_bug.cgi?id=852224#c Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Alias| |CVE-2013-6394 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=852224 https://bugzilla.novell.com/show_bug.cgi?id=852224#c7 --- Comment #7 from Swamp Workflow Management 2013-12-12 17:05:51 UTC --- openSUSE-SU-2013:1864-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 852224 CVE References: CVE-2013-6394 Sources used: openSUSE 13.1 (src): xtrabackup-2.1.6-5.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=852224 https://bugzilla.novell.com/show_bug.cgi?id=852224#c9 Andreas Stieger changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |RESOLVED --- Comment #9 from Andreas Stieger 2014-01-25 23:32:23 UTC --- 2.1.7 has a follow-up on the IV: Percona XtraBackup now uses libgcrypt built in randomization functions for setting the Initialization Vector. http://www.mysqlperformanceblog.com/2014/01/24/percona-xtrabackup-2-1-7-now-... https://bugs.launchpad.net/percona-xtrabackup/+bug/1255300 Tracking in #860488 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=852224 https://bugzilla.novell.com/show_bug.cgi?id=852224#c10 --- Comment #10 from Swamp Workflow Management 2014-02-18 09:04:46 UTC --- openSUSE-SU-2014:0245-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 852224,860488 CVE References: CVE-2013-6394 Sources used: openSUSE 13.1 (src): xtrabackup-2.1.7-9.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.