CVE-2017-7252
📋 TL;DR
This vulnerability in Botan's bcrypt implementation incorrectly handles passwords between 57-72 characters, allowing attackers to more easily crack hashed passwords. It affects any system using Botan library versions before 2.1.0 for password hashing. The flaw reduces the security of password storage mechanisms.
💻 Affected Systems
- Botan cryptography library
📦 What is this software?
Botan by Botan Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could recover plaintext passwords from bcrypt hashes, leading to complete account compromise and potential lateral movement within systems.
Likely Case
Targeted password cracking attacks against specific accounts where attackers have obtained password hashes through other means.
If Mitigated
With proper password policies (length limits) and hash rotation, impact is limited to historical password data.
🎯 Exploit Status
Exploitation requires access to password hashes. Attack involves offline password cracking with reduced computational complexity for affected password lengths.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.0 and later
Vendor Advisory: https://botan.randombit.net/security.html
Restart Required: Yes
Instructions:
1. Update Botan library to version 2.1.0 or later. 2. Recompile applications using Botan. 3. Restart affected services. 4. Consider re-hashing passwords with updated library.
🔧 Temporary Workarounds
Password length restriction
allEnforce password policies limiting passwords to 56 characters or less to avoid the vulnerable range
Use alternative hashing algorithm
allTemporarily switch to SHA-256 or other secure hashing algorithms until Botan can be updated
🧯 If You Can't Patch
- Implement password length restrictions (max 56 characters) in all authentication systems
- Force password resets for all users and re-hash with workaround algorithm
🔍 How to Verify
Check if Vulnerable:
Check Botan version with: botan version or examine library files. Versions <2.1.0 are vulnerable.Check Version:
botan version or check library version in package managerVerify Fix Applied:
Verify Botan version is >=2.1.0 and test bcrypt hashing with 57-72 character passwords returns correct hashes.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication failures for specific accounts
- Multiple password reset requests
Network Indicators:
- Large volumes of authentication attempts against specific accounts
SIEM Query:
Authentication failures where username contains passwords 57-72 chars OR multiple failed logins for same account in short period