this post was submitted on 20 Jun 2023

13 points (93.3% liked)

Free and Open Source Software

17571 readers

25 users here now

If it's free and open source and it's also software, it can be discussed here. Subcommunity of Technology.

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago

MODERATORS

[email protected]

BSI warnt vor KeePassXC-Schwachstellen / BSI warns of vulnerabilities in the password manager KeePassXC (www.heise.de)

submitted 1 year ago by [email protected] to c/[email protected]

25 comments fedilink hide all child comments

[email protected] - BSI warnt vor KeePassXC-Schwachstellen

Das BSI warnt vor Schwachstellen im Passwort-Manager KeePassXC. Angreifer können Dateien oder das Master-Passwort ohne Authentifzierungsrückfrage manipulieren.

[The BSI warns of vulnerabilities in the password manager KeePassXC. Attackers can manipulate files or the master password without authentication confirmation.]

top 23 comments

sorted by: hot top controversial new old

[–] [email protected] 6 points 1 year ago

Here is KeePassXC's response: https://keepassxc.org/blog/2023-06-20-cve-202335866

Basically some random guy with weird misconceptions about security decided this was an issue, it's obviously not. Honestly concerning that he was able to easily get a CVE for this and even get articles about it published on some websites.

[–] [email protected] 6 points 1 year ago (1 children)

Lock the pc, if you leave and lock the db, if pc is locked, lid is closed and this is absolute a non-issue.

German BSI is sometimes a little bit over motivated ;-)

[–] [email protected] 1 points 1 year ago

You don't even need to lock the pc, locking the db is sufficient. The issue allows changing the settings on unlocked databases without needing to re-confirm (at least according to the article).

[–] [email protected] 6 points 1 year ago* (last edited 1 year ago) (2 children)

KeePassXC is not affected by this vulnerability.

Edit: Different issue.

[–] lowleveldata 2 points 1 year ago* (last edited 1 year ago) (1 children)

CVE-2023-32784

That's not the issue mentioned in the article. Which is CVE-2023-35866.

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago)

gotcha

Added to original comment. Both are recent issues, so confusion is forgivable.

[–] [email protected] 1 points 1 year ago (1 children)

This is also the vulnerability that made many people delete Keepass 2 for XC many months ago so it is very strange that they make an article that sounds like it's a new vulnerability.

[–] [email protected] 0 points 1 year ago* (last edited 1 year ago) (1 children)

Wrong vulnerability. The discovered one is CVE-2023-35866, which is still pending verification* (analysis).

This affects KeePassXC. https://nvd.nist.gov/vuln/detail/CVE-2023-35866

[–] [email protected] 1 points 1 year ago

Thanks for the correction. In that case going to be interesting how this issue progress.

[–] lowleveldata 5 points 1 year ago* (last edited 1 year ago) (2 children)

Can't read German. What is required to perform this attack?

[–] lowleveldata 9 points 1 year ago (1 children)

Ok I checked it up (CVE-2023-35866). It basically says an attacker may export everything if they have access to your unlocked database. Which seems... obvious? The project contributors says it's not a vulnerability which I incline to agree.

[–] [email protected] 5 points 1 year ago

You mean to say that if I leave my door unlocked, somebody might come in? This is shocking news!

[–] [email protected] 1 points 1 year ago

Google translation into English:

https://www-heise-de.translate.goog/news/BSI-warnt-vor-KeePassXC-Schwachstellen-9192374.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp

[+] [email protected] 1 points 1 year ago (1 children)

[deleted]

[–] [email protected] 2 points 1 year ago (2 children)

It's a denial of service vulnerability. Requiring the existing master password to change the master password will stop a drive by miscreant denying you access to your db. And password change system I've ever used has required the existing password to he entered first.

Likewise a full db export feel like a big enough deal to require authorization.

If you're careful and lock your machine when you leave it then you should be pretty safe. I'm surprised these aren't already features.

[–] [email protected] 6 points 1 year ago (1 children)

No, requiring the existing master password won't help. A drive by miscreant with access to an unlocked computer with an unlocked DB can delete all the DB entries. If the DB is locked they can just delete the DB file. KeePassXC can't defend against this, that takes properly functioning versioned backups.

[–] [email protected] 1 points 1 year ago

yeah, maybe denial of service isn't it. I replied to a comment above why I think it should still be protected functionality to help prevent data leak.

[–] [email protected] 0 points 1 year ago (1 children)

They could just delete the file to deny you access to your db?

[–] [email protected] 1 points 1 year ago

Yeah, that's fair. But a full db export that they could then email themselves. It'd be nice to have some more protection against that. Or Change the master password and email the encrypted file to themselves.

[–] [email protected] 0 points 1 year ago (3 children)

Why is there no link to the article?

[–] [email protected] 3 points 1 year ago

On Jerboa(List View) the link is on the thumbail, maybe it's the same in the browser version. Keep in mind that the article on heise is in german.

[–] [email protected] 3 points 1 year ago* (last edited 1 year ago)

There is if you click on the image.

load more comments