CVE-2019-19521

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/authsubr.c and gen/authenticate.c in libc and login/login.c and xenocara/app/xenodm/greeter/verify.c...

OpenBSD 6.6 Multiple Authentication Bypass Vulnerabilities

Binary data openbsdauthbypass.nbin...

OpenBSD Hit with Authentication, LPE Bugs

An authentication bypass and three local privilege-escalation LPE bugs have been uncovered in OpenBSD, the Unix-like open-source operating system known for its security protections. The most severe of the vulnerabilities is the bypass CVE-2019-19521, which is remotely exploitable. OpenBSD uses BS...

Severe Auth Bypass and Priv-Esc Vulnerabilities Disclosed in OpenBSD

OpenBSD, an open-source operating system built with security in mind, has been found vulnerable to four new high-severity security vulnerabilities, one of which is an old-school type authentication bypass vulnerability in BSD Auth framework. The other three vulnerabilities are privilege escalatio...

OpenBSD Multiple Authentication Vulnerabilities

Multiple authentication vulnerabilities in OpenBSD have been disclosed by Qualys Research Labs. The vulnerabilities are assigned following CVEs: CVE-2019-19522, CVE-2019-19521, CVE-2019-19520, CVE-2019-19519. OpenBSD developers have confirmed the vulnerabilities and also provided a quick response...

Qualys Security Advisory - OpenBSD Authentication Bypass / Privilege Escalation

Qualys Security Advisory Authentication vulnerabilities in OpenBSD ============================================================================== Contents ============================================================================== 1. CVE-2019-19521: Authentication bypass 1.1. Analysis 1.2. Cas...

CVE-2019-19521

CVE-2019-19521 affects OpenBSD 6.6 libc and enables authentication bypass via the -schallenge username, exploitable remotely in smtpd, ldapd, or radiusd. Root cause ties to libc code paths gen/auth_subr.c and gen/authenticate.c (also related login.c and xenocara/greeter/verify.c). OpenBSD patches...