CVE

Id
67269  
CVE No.
CVE-2013-7322  
Status
Candidate  
Description
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.  
Phase
Assigned (20140209)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
649227 67269 CVE-2013-7322 MLIST:[OATH-Toolkit-help] 20131209 libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file?  View
649228 67269 CVE-2013-7322 URL:http://lists.nongnu.org/archive/html/oath-toolkit-help/2013-12/msg00000.html  View
649229 67269 CVE-2013-7322 MLIST:[OATH-Toolkit-help] 20131214 Re: libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file?  View
649230 67269 CVE-2013-7322 URL:http://lists.nongnu.org/archive/html/oath-toolkit-help/2013-12/msg00003.html  View
649231 67269 CVE-2013-7322 MLIST:[OATH-Toolkit-help] 20131214 Re: libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file?  View
649232 67269 CVE-2013-7322 URL:http://lists.nongnu.org/archive/html/oath-toolkit-help/2013-12/msg00002.html  View
649233 67269 CVE-2013-7322 MLIST:[oss-security] 20140209 Re: oath-toolkit PAM module OTP token invalidation issue  View
649234 67269 CVE-2013-7322 URL:http://seclists.org/oss-sec/2014/q1/296  View
649235 67269 CVE-2013-7322 CONFIRM:http://www.nongnu.org/oath-toolkit/NEWS.html  View
649236 67269 CVE-2013-7322 XF:oath-toolkit-cve20137322-replay(91316)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
24486 JVNDB-2013-006061 PHP の ext/gd/gd.c の gdImageCrop 関数におけるサービス運用妨害 (DoS) の脆弱性 PHP の ext/gd/gd.c の gdImageCrop 関数には、サービス運用妨害 (アプリケーションクラッシュ) 状態にされるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2013-7327 67269 7.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006061.html  View