420 matches found
Phabricator: TOTP Key is shorter than RFC 4226 recommended minimum
mongoose Observed Behavior: When creating a TOTP secret a 16 character base32 encoded string is presented to the user. Expected Behavior: I would expect a 32 character base32 secret to be presented. The RFC recommends 160 bits of entropy, which is 32 character x 5 bits per character in a base32...
Authentication flaw
The time-based one-time-password TOTP function in the application logic of the Green Electronics RainMachine Mini-8 2nd generation uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "Use of Password Hash Instead of...
CVE-2018-6011
The time-based one-time-password TOTP function in the application logic of the Green Electronics RainMachine Mini-8 2nd generation uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "Use of Password Hash Instead of...
CVE-2018-6011
The CVE-2018-6011 entry concerns the Green Electronics RainMachine Mini-8 (2nd generation). The TOTP function in the device’s application logic uses the administrator’s password hash to generate a 6-digit temporary passcode, enabling remote or local access. Affected component: the rainmachine-set...
CVE-2018-6011
The time-based one-time-password TOTP function in the application logic of the Green Electronics RainMachine Mini-8 2nd generation uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "Use of Password Hash Instead of...
FreeBSD : gitea -- TOTP passcode reuse (bcf56a42-9df8-11e8-afb0-589cfc0f81b0)
The Gitea project reports : TOTP passcodes can be reused. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use in source VuXML and...
gitea -- TOTP passcode reuse
The Gitea project reports: TOTP passcodes can be reused...
Nextcloud: twofactor_auth bypassable if provider fails to load
Just want to preface this by saying that this is probably not a significant vulnerability, as it requires that the server either have recently been incorrectly upgraded or otherwise misconfigured. However in the administration of my own personal NextCloud instance I have hit this several times...
Security advisory YSA-2018-01 | Yubico
Oscar Mira and Roi Martin from the Schibsted security team informed us of a security issue in the OATH Initiative for Open Authentication applet on the YubiKey NEO. The YubiKey OATH applet is used to generate time-based one-time password TOTP and HMAC-based one-time password HOTP codes that are...
Legal Robot: 2FA manual entry uses wrong encoding
As in report 260491, a security researcher discovered that following another change from report 259415, we used the wrong encoding for the manually entered secret. No sensitive data was exposed and there was no security risk, but users were unable to manually register a new TOTP device for about ...
Legal Robot: No notification on change password feature
A security researcher discovered that Legal Robot did not send notifications on important account changes, like password changes. While there was no specific security vulnerability, we decided to add notifications for Password Change, TOTP Enable/Disable, U2F Enable/Disable, Recovery Code Use, an...
Legal Robot: Missing Issuer parameter on TOTP 2FA
During our 2FA challenge, a security researcher discovered that the Issuer parameter was not set in the TOTP URL that gets turned into a QR Code. While there is no direct security impact, it does make 2FA software tokens more difficult to manage...
Legal Robot: Missing link to TOTP manual enroll option
While going live with additional 2FA options, a security researcher discovered that during TOTP enrollment, only a barcode was displayed to users, no TOTP manual enroll option with a printed base32 secret was provided for non-smartphone users...
[SECURITY] Fedora 20 Update: oath-toolkit-2.4.1-6.fc20
The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools an d a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...
[SECURITY] Fedora 21 Update: oath-toolkit-2.4.1-6.fc21
The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools an d a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...
Fedora Update for oath-toolkit FEDORA-2014-2875
Check for the Version of oath-toolkit OpenVAS Vulnerability Test Fedora Update for oath-toolkit FEDORA-2014-2875 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...
[SECURITY] Fedora 20 Update: oath-toolkit-2.4.1-3.fc20
The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools an d a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...
[SECURITY] Fedora 19 Update: oath-toolkit-2.4.1-1.fc19
The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools an d a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...
SA-CONTRIB-2013-047 - Google Authenticator login - Access Bypass
This module will allow you to add Time-based One-time Password Algorithm also called "Two Step Authentication" or "Multi-Factor Authentication" support to user logins. It works with Google's Authenticator app system and support most if not all OATH based HOTP/TOTP systems. Accidental removal of...
