linuxdcpp-team team mailing list archive

[Andy Chmilenko <920794@xxxxxxxxxxxxxxxxxx>]

*** This bug is a security vulnerability ***

Private security bug reported:

>From my investigation and experience, Util::initialize() never called
which contains the sgenrand call that seeds the random number generator
to the time.

seed always 4357 set from rand() when salts are generated. The same
salts are used every time from start up.

I think this is kind of missing the point of random salts to a point.

** Affects: adchpp
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of
Dcplusplus-team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/920794

Title:
  Util::initialize() never called. same seed used every startup

Status in ADCH++:
  New

Bug description:
  From my investigation and experience, Util::initialize() never called
  which contains the sgenrand call that seeds the random number
  generator to the time.

  seed always 4357 set from rand() when salts are generated. The same
  salts are used every time from start up.

  I think this is kind of missing the point of random salts to a point.

To manage notifications about this bug go to:
https://bugs.launchpad.net/adchpp/+bug/920794/+subscriptions