is public, via oss-sec


http://openwall.com/lists/oss-security/2013/05/28/5

From: Michael Samuel <mik@...net.net>
Subject: KDE Paste Applet

The paste applet included with kdeplasma-addons allows you to define
macros that will copy some generated data into the clipboard, using
simple macros to define the source and format of the data.

The available macros include %{password(...)} which generates "random"
passwords.

Here is the code that generates the passwords (from pastemacroexpander.cpp):

    QDateTime now = QDateTime::currentDateTime();
    qsrand(now.toTime_t() / now.time().msec());
    for (int i = 0; i < charCount; ++i) {
        result += chars[qrand() % chars.count()];
    }

Breaking passwords generated by this (for example from leaked password
hashes) can be done extremely quickly, especially if a password expiry
or other hint is stored with the password.

Workaround: You can change the macro you were using to a %{exec(...)}
macro which calls a secure password generator.  Please select your
replacement carefully.

I reported this to security at kde.org and created a launchpad ticket
against the Ubuntu package on May 13, followed up with a proof of
concept on the 17th, and have received no response at all from either.
 Apologies if that was the wrong contact method.

Regards,
  Michael