NVD

Id
42051  
Name
CVE-2013-7322  
Description
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.  
Reject
 
CVSS Version
2  
CVSS Score
4.9  
Severity
Medium  
CVSS Base Score
4.9  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:N)  
Pub Date
2017-01-18  
Published
2014-03-09  
Modified Date
2014-03-10  
Seq
2013-7322  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
212261 42051 CVE-2013-7322 [OATH-Toolkit-help] 20131209 libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file?  View
212262 42051 CVE-2013-7322 [OATH-Toolkit-help] 20131214 Re: libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file?  View
212263 42051 CVE-2013-7322 [OATH-Toolkit-help] 20131214 Re: libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file?  View
212264 42051 CVE-2013-7322 [oss-security] 20140209 Re: oath-toolkit PAM module OTP token invalidation issue  View
212265 42051 CVE-2013-7322 http://www.nongnu.org/oath-toolkit/NEWS.html  View
212266 42051 CVE-2013-7322 oath-toolkit-cve20137322-replay(91316)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24561 JVNDB-2013-006136 OATH Toolkit の liboath の usersfile.c におけるリプレイ攻撃を実行される脆弱性 OATH Toolkit の liboath の usersfile.c は、/etc/users.oath 内の無効なワンタイムパスワード (OTP) のタイプおよびユーザ名を含む行を適切に処理しないため、OTP が無効な場合に間違った行がアップデートされ、リプレイ攻撃を実行される脆弱性が存在します。 CVE-2013-7322 67264 CVE-2013-7322 42051 4.9 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006136.html 2013-12-09 2014-03-11 View