Qualys Security Advisory - OpenBSD Authentication Bypass / Privilege Escalation

Qualys Security Advisory Authentication vulnerabilities in OpenBSD ============================================================================== Contents ============================================================================== 1. CVE-2019-19521: Authentication bypass 1.1. Analysis 1.2. Cas...

OpenBSD has an unspecified vulnerability (CNVD-2019-44737)

OpenBSD is a cross-platform, BSD-based UNIX-like operating system from the Canadian OpenBSD project team. A security vulnerability exists in OpenBSD version 6.6. When the S/Key or YubiKey authentication mechanism is turned on, a local attacker can exploit the vulnerability to become the root user...

CVE-2019-19522

OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root...

CVE-2019-19522

OpenBSD 6.6 is affected when S/Key or YubiKey authentication is enabled (non-default). A local attacker in the auth group can escalate to root because root’s file can be written to /etc/skey or /var/db/yubikey and need not be owned by root. This CVE corresponds to CVE-2019-19522. Reported impact ...

Gentoo Security Advisory GLSA 201402-12

Gentoo Linux Local Security Checks GLSA 201402-12 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

CVE-2013-4285

A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory, which allows local users to obtain sensitive information by reading system memory...

Design/Logic Flaw

A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory, which allows local users to obtain sensitive information by reading system memory...

CVE-2013-4285

The CVE concerns Gentoo’s patch to the PAM S/Key module that fails to clear credentials from memory. A local attacker with privileged access could inspect memory dumps to obtain cleartext credentials. Affected software is the PAM S/Key module used by Gentoo; the underlying issue is that credentia...

CVE-2013-4285

A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory, which allows local users to obtain sensitive information by reading system memory...

GLSA-201402-12 : PAM S/Key: Information disclosure

The remote host is affected by the vulnerability described in GLSA-201402-12 PAM S/Key: Information disclosure Ulrich Mller reported that a Gentoo patch to PAM S/Key does not remove credentials provided by the user from memory. Impact : A local attacker with privileged access could inspect a memo...

PAM S/Key: Information disclosure

Background PAM S/Key is a pluggable authentication module for the OpenBSD Single-key Password system. Description Ulrich Müller reported that a Gentoo patch to PAM S/Key does not remove credentials provided by the user from memory. Impact A local attacker with privileged access could inspect a...

OpenSSH S/KEY Authentication Account Enumeration

When OpenSSH has S/KEY authentication enabled, it is possible to remotely determine if an account configured for S/KEY authentication exists. Note that Nessus has not attempted to exploit the issue but has instead only checked if OpenSSH is running on the remote host. As a result, it will not...

S/Key和OPIE数据库漏洞

在使用S/Key或OPIE认证的服务器上存在一个安全漏洞。这个漏洞允许本地用户获得对S/Key或OPIE数据库的访问权。 S/Key是使用一次性口令技术的认证机制。系统管理员可以进行配置，使用户能够通过S/Key认证访问使用login8的任何服务，如Telnet和FTP。制定认证类型的配置文件是/etc/login.conf。 为了配置一个用户能够使用S/Key，管理员或该用户（如果程序是suid root）首先必须使用skeyinit（或keyinit）程序。这个程序初始化S/Key数据库（/etc/skeykeys）中的用户入口项。这个数据库文件包含输入S/Key口令时需要比较的信息...

Debian: Security Advisory (DSA-457)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...

CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication. OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different...

DEBIAN-CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...

CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...

CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...