Does not generate random passwords

[Ingo Ruhnke]

Binary package hint: makepasswd

makepasswd doesn't use /dev/random to generate the password as the description claims, but only uses /dev/random to generate a 32bit seed for the insecure srand/rand functions. This limits it to a pool of just 2**32 possible passwords which is much less the it should be able to produce given the default length of 6-8 characters (which also sounds rather short) out of a collection of 58.

[Ingo Ruhnke (grumbel)]

Ubuntu 8.04
makepasswd: 1.10-3

[Henrik Holst (millihenrik)]

I have noticed the very same and have created a patch that solves it, I have sent the patch up to mainline as well.

[Henrik Holst (millihenrik)]

Please ignore my previous comment, I had this confused with a C program with the exact same name (makepasswd) that had the exact same bug :-|

[Colin Watson (cjwatson)]

Fixed some time back. Sorry I didn't notice this report.

makepasswd (1.10-5) unstable; urgency=low

  * Imported into a branch on bzr.debian.org; add Vcs-Bzr and Vcs-Browser
    control fields.
  * Use OpenSSL's random number generator, seeded with 256 bits of entropy
    from /dev/urandom (CVE-2010-2247; closes: #564559).

 -- Colin Watson <email address hidden> Mon, 22 Feb 2010 00:39:50 +0000