CVE-2013-7322

2014-03-0913:16:00

Debian Security Bug Tracker

security-tracker.debian.org

0.002 Low

EPSS

Percentile

51.4%

JSON

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.

OSVersionArchitecturePackageVersionFilename
Debian12alloath-toolkit< 2.4.1-1oath-toolkit_2.4.1-1_all.deb
Debian11alloath-toolkit< 2.4.1-1oath-toolkit_2.4.1-1_all.deb
Debian10alloath-toolkit< 2.4.1-1oath-toolkit_2.4.1-1_all.deb
Debian999alloath-toolkit< 2.4.1-1oath-toolkit_2.4.1-1_all.deb
Debian13alloath-toolkit< 2.4.1-1oath-toolkit_2.4.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	oath-toolkit	< 2.4.1-1	oath-toolkit_2.4.1-1_all.deb
Debian	11	all	oath-toolkit	< 2.4.1-1	oath-toolkit_2.4.1-1_all.deb
Debian	10	all	oath-toolkit	< 2.4.1-1	oath-toolkit_2.4.1-1_all.deb
Debian	999	all	oath-toolkit	< 2.4.1-1	oath-toolkit_2.4.1-1_all.deb
Debian	13	all	oath-toolkit	< 2.4.1-1	oath-toolkit_2.4.1-1_all.deb

0.002 Low

EPSS

Percentile

51.4%

JSON

Related for DEBIANCVE:CVE-2013-7322