> Someone has contacted me about a security issue with Majordomo 1.94.5
> (the current release). Essentially, the algorithm used to generate
> cookies for use in "auth" commands is weak and easily reversible.
They're right, but the main problem is that people often forget to change
the default nonce used to generate them.
Given the level of the threat, if you simply advise people to change the
nonce, and to use different ones if they have multiple mj1 setups for
different virtual domains, that should be fine.
I'd rather put effort into sticking a stake in the ground to ship mj 2.0
so people will believe that it's a released product.
Regards,
John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.
Follow-Ups:
References:
|
|
