>Number:         2912
>Category:       bin
>Synopsis:       cksum is not secure
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Fri Nov  1 11:50:01 1996
>Last-Modified:
>Originator:     Chris Jones
>Organization:
-------------------------------------------------------------------------------
Chris Jones                                      cjones@rupert.oscs.montana.edu
           Mad scientist in training...
"Is this going to be a stand-up programming session, sir, or another bug hunt?"
>Release:        1.1
>Environment:
	
System: NetBSD rupert.oscs.montana.edu 1.2_BETA NetBSD 1.2_BETA (SLIM) #7: Tue Aug 6 19:52:09 MDT 1996 cjones@rupert.oscs.montana.edu:/home/src/sys/arch/mac68k/compile/SLIM mac68k


>Description:
	
Mtree just uses a CRC from the cksum program to do its checksum.
However, as I understand things, this algorithm is generally regarded
as easy to fool; a hacker could read the checksum from the mtree file,
make a trojan horse out of whatever binary, and then pad the binary
until it had the right CRC.
>How-To-Repeat:
	
>Fix:
	
MD4, MD5, or something similarly robust.
>Audit-Trail:
>Unformatted: