Core/Auth: Per SRP6a protocol, terminate connection of A % N == 0. This resolves another authentication bypass issue
This commit is contained in:
@@ -557,7 +557,7 @@ bool AuthSocket::_HandleLogonProof()
|
|||||||
A.SetBinary(lp.A, 32);
|
A.SetBinary(lp.A, 32);
|
||||||
|
|
||||||
// SRP safeguard: abort if A == 0
|
// SRP safeguard: abort if A == 0
|
||||||
if (A.isZero())
|
if ((A % N).isZero())
|
||||||
{
|
{
|
||||||
socket().shutdown();
|
socket().shutdown();
|
||||||
return true;
|
return true;
|
||||||
|
|||||||
Reference in New Issue
Block a user