Developed by community.

http://marc.info/?l=oss-security&m=137049241132104&w=4

Fix following CVEs:

CVE-2013-4440, CVE-2013-4441, CVE-2013-4442, CVE-2013-4443

with an exception of number bias in short passwords (won't be fixed,

it's a feature)

--- pwgen-2.06/configure.in	2007-07-05 09:42:19.000000000 +1000

+++ pwgen-2.06-mik/configure.in	2013-05-27 16:48:46.399195554 +1000

@@ -6,7 +6,7 @@

 AC_PATH_PROG(RM, rm, rm)

 AC_PATH_PROG(SED, sed, sed)

 AC_PATH_PROG(PERL, perl, perl)

-AC_CHECK_FUNCS(drand48 getopt_long)

+AC_CHECK_FUNCS(getopt_long)

 AC_CHECK_HEADERS(getopt.h)

 pwgen_sha="internal"

 SHA_OBJ=""

--- pwgen-2.06/debian/control	2013-06-06 09:57:01.000000000 +1000

+++ pwgen-2.06-mik/debian/control	2013-06-06 10:05:44.315608968 +1000

@@ -8,6 +8,7 @@

 Package: pwgen

 Architecture: any

 Depends: ${shlibs:Depends}

+Suggests: passwdqc

 Description: Automatic Password generation

  pwgen generates random, meaningless but pronounceable passwords.

  These passwords contain either only lowercase letters, or upper

--- pwgen-2.06/pwgen.c	2013-06-06 09:57:01.000000000 +1000

+++ pwgen-2.06-mik/pwgen.c	2013-06-06 13:50:19.541188659 +1000

@@ -25,7 +25,7 @@

 int	pw_length = 8;

 int	num_pw = -1;

-int	pwgen_flags = 0;

+int	pwgen_flags = PW_LOWERS | PW_UPPERS | PW_DIGITS;

 int	do_columns = 0;

 #ifdef HAVE_GETOPT_LONG

@@ -42,11 +42,12 @@

 	{ "sha1", required_argument, 0, 'H' },

 	{ "ambiguous", no_argument, 0, 'B' },

 	{ "no-vowels", no_argument, 0, 'v' },

+	{ "insecure-phonemes", no_argument, 0, 'P' },

 	{ 0, 0, 0, 0}

 };

 #endif

-const char *pw_options = "01AaBCcnN:shH:vy";

+const char *pw_options = "01AaBCcnN:shH:vyP";

 static void usage(void)

 {

@@ -82,6 +83,8 @@

 	fputs("  -v or --no-vowels\n", stderr);

 	fputs("\tDo not use any vowels so as to avoid accidental nasty words\n",

 	      stderr);

+	fputs("  -P or --insecure-phonemes\n", stderr);

+	fputs("\tGenerate insecure phonemes, as was previously the default\n", stderr);

 	exit(1);

 }

@@ -94,11 +97,10 @@

 	char	*buf, *tmp;

 	void	(*pwgen)(char *inbuf, int size, int pw_flags);

-	pwgen = pw_phonemes;

+	pwgen = pw_rand;

 	pw_number = pw_random_number;

 	if (isatty(1)) {

 		do_columns = 1;

-		pwgen_flags |= PW_DIGITS | PW_UPPERS;

 	}

 	while (1) {

@@ -140,6 +144,9 @@

 			pwgen = pw_rand;

 			pwgen_flags = PW_DIGITS | PW_UPPERS;

 			break;

+		case 'P':

+			pwgen = pw_phonemes;

+			break;

 		case 'C':

 			do_columns = 1;

 			break;

--- pwgen-2.06/pwgen.h	2007-07-05 09:42:19.000000000 +1000

+++ pwgen-2.06-mik/pwgen.h	2013-06-06 10:08:42.186709620 +1000

@@ -28,6 +28,7 @@

 #define PW_SYMBOLS	0x0004

 #define PW_AMBIGUOUS	0x0008

 #define PW_NO_VOWELS	0x0010

+#define PW_LOWERS	0x0020  /* At least one lowercase! */

 /* pointer to choose between random or sha1 pseudo random number generator */

 extern int (*pw_number)(int max_num);

--- pwgen-2.06/pw_rand.c	2007-07-05 09:42:19.000000000 +1000

+++ pwgen-2.06-mik/pw_rand.c	2013-06-06 13:51:38.948600125 +1000

@@ -72,10 +72,12 @@

 			feature_flags &= ~PW_UPPERS;

 		if (strchr(pw_symbols, ch))

 			feature_flags &= ~PW_SYMBOLS;

+		if (strchr(pw_lowers, ch))

+			feature_flags &= ~PW_LOWERS;

 	}

-	if (feature_flags & (PW_UPPERS | PW_DIGITS | PW_SYMBOLS))

+	if (feature_flags & (PW_UPPERS | PW_DIGITS | PW_SYMBOLS | PW_LOWERS))

 		goto try_again;

 	buf[size] = 0;

 	free(chars);

 	return;

-}	

+}

--- pwgen-2.06/randnum.c	2007-07-05 09:42:19.000000000 +1000

+++ pwgen-2.06-mik/randnum.c	2013-06-06 10:00:23.149212710 +1000

@@ -7,53 +7,45 @@

  * License.

  */

+#include <stdio.h>

+#include <string.h>

 #include <unistd.h>

 #include <stdlib.h>

 #include <sys/types.h>

-#include <sys/time.h>

 #include <sys/stat.h>

 #include <fcntl.h>

 #include <errno.h>

 #include "pwgen.h"

-#ifdef HAVE_DRAND48

-extern double drand48(void);

-#endif

-

 static int get_random_fd(void);

 /* Borrowed/adapted from e2fsprogs's UUID generation code */

 static int get_random_fd()

 {

-	struct timeval	tv;

-	static int	fd = -2;

-	int		i;

+	static int fd = -2;

-	if (fd == -2) {

-		gettimeofday(&tv, 0);

+	if(fd == -2) {

 		fd = open("/dev/urandom", O_RDONLY);

-		if (fd == -1)

-			fd = open("/dev/random", O_RDONLY | O_NONBLOCK);

-#ifdef HAVE_DRAND48

-		srand48((tv.tv_sec<<9) ^ (getpgrp()<<15) ^

-			(getpid()) ^ (tv.tv_usec>>11));

-#else

-		srandom((getpid() << 16) ^ (getpgrp() << 8) ^ getuid() 

-		      ^ tv.tv_sec ^ tv.tv_usec);

-#endif

+		if (fd == -1) {

+			fprintf(stderr, "Unable to open /dev/urandom: %s\n", strerror(errno));

+			abort();

+		}

 	}

-	/* Crank the random number generator a few times */

-	gettimeofday(&tv, 0);

-	for (i = (tv.tv_sec ^ tv.tv_usec) & 0x1F; i > 0; i--)

-#ifdef HAVE_DRAND48

-		drand48();

-#else

-		random();

-#endif

 	return fd;

 }

+static unsigned int get_mask(int max_num)

+{

+	unsigned int numBits = 0;

+	while(max_num > 0)

+	{

+		numBits++;

+		max_num >>= 1;

+	}

+	return (1<<numBits) - 1;

+}

+

 /*

  * Generate a random number n, where 0 <= n < max_num, using

  * /dev/urandom if possible.

@@ -62,34 +54,20 @@

 	int max_num;

 {

 	int i, fd = get_random_fd();

-	int lose_counter = 0, nbytes=4;

 	unsigned int rand_num;

-	char *cp = (char *) &rand_num;

-	if (fd >= 0) {

-		while (nbytes > 0) {

-			i = read(fd, cp, nbytes);

-			if ((i < 0) &&

-			    ((errno == EINTR) || (errno == EAGAIN)))

-				continue;

-			if (i <= 0) {

-				if (lose_counter++ == 8)

-					break;

-				continue;

-			}

-			nbytes -= i;

-			cp += i;

-			lose_counter = 0;

-		}

+	i = read(fd, (void *)&rand_num, sizeof(rand_num));

+	if(i < 0) {

+		fprintf(stderr, "Error reading from /dev/urandom: %s\n", strerror(errno));

+		abort();

 	}

-	if (nbytes == 0)

-		return (rand_num % max_num);

-	/* OK, we weren't able to use /dev/random, fall back to rand/rand48 */

+        rand_num &= get_mask(max_num);

-#ifdef HAVE_DRAND48

-	return ((int) ((drand48() * max_num)));

-#else

-	return ((int) (random() / ((float) RAND_MAX) * max_num));

-#endif

+	if(rand_num < max_num) {

+		return rand_num;

+	}

+

+	return pw_random_number(max_num); /* tail-recurse */

 }

+