CVE-2013-7322 usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to...
MediumCVSS 4.9
EPSS 0.88%
- Published
- Updated
- Exploit status
- No public exploit known
Description
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/oath-toolkit(Debian:12) | < 2.4.1-1 | 2.4.1-1 |
| debian/oath-toolkit(Debian:13) | < 2.4.1-1 | 2.4.1-1 |
| debian/oath-toolkit(Debian:14) | < 2.4.1-1 | 2.4.1-1 |
| nongnu oath toolkit | <= 2.4.0 | No fix listed |
| nongnu oath toolkit | = 1.0.0 | No fix listed |
| nongnu oath toolkit | = 1.0.1 | No fix listed |
| nongnu oath toolkit | = 1.2.0 | No fix listed |
| nongnu oath toolkit | = 1.2.1 | No fix listed |
| nongnu oath toolkit | = 1.2.2 | No fix listed |
| nongnu oath toolkit | = 1.4.0 | No fix listed |
| nongnu oath toolkit | = 1.4.1 | No fix listed |
| nongnu oath toolkit | = 1.4.2 | No fix listed |
| nongnu oath toolkit | = 1.4.3 | No fix listed |
| nongnu oath toolkit | = 1.4.4 | No fix listed |
| nongnu oath toolkit | = 1.4.5 | No fix listed |
| nongnu oath toolkit | = 1.4.6 | No fix listed |
| nongnu oath toolkit | = 1.6.0 | No fix listed |
| nongnu oath toolkit | = 1.6.1 | No fix listed |
| nongnu oath toolkit | = 1.6.2 | No fix listed |
| nongnu oath toolkit | = 1.6.3 | No fix listed |
| nongnu oath toolkit | = 1.6.4 | No fix listed |
| nongnu oath toolkit | = 1.8.0 | No fix listed |
| nongnu oath toolkit | = 1.8.1 | No fix listed |
| nongnu oath toolkit | = 1.8.2 | No fix listed |
| nongnu oath toolkit | = 1.10.0 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nongnu oath toolkit | = 1.10.1 | No fix listed |
| nongnu oath toolkit | = 1.10.2 | No fix listed |
| nongnu oath toolkit | = 1.10.3 | No fix listed |
| nongnu oath toolkit | = 1.10.4 | No fix listed |
| nongnu oath toolkit | = 1.10.5 | No fix listed |
| nongnu oath toolkit | = 1.12.0 | No fix listed |
| nongnu oath toolkit | = 1.12.1 | No fix listed |
| nongnu oath toolkit | = 1.12.2 | No fix listed |
| nongnu oath toolkit | = 1.12.3 | No fix listed |
| nongnu oath toolkit | = 1.12.4 | No fix listed |
| nongnu oath toolkit | = 1.12.5 | No fix listed |
| nongnu oath toolkit | = 1.12.6 | No fix listed |
| nongnu oath toolkit | = 2.0.0 | No fix listed |
| nongnu oath toolkit | = 2.0.1 | No fix listed |
| nongnu oath toolkit | = 2.0.2 | No fix listed |
| nongnu oath toolkit | = 2.2.0 | No fix listed |
References
- Debian Security Tracker CVE-2013-7322 vendor-advisory
- [OATH-Toolkit-help] 20131209 libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file? mailing-list
- [OATH-Toolkit-help] 20131214 Re: libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file? mailing-list
- [OATH-Toolkit-help] 20131214 Re: libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file? mailing-list
- [oss-security] 20140209 Re: oath-toolkit PAM module OTP token invalidation issue mailing-list
- www.nongnu.org
- oath-toolkit-cve20137322-replay(91316) vdb-entry
- bugs.debian.org issue-tracking