Authentication vulnerabilities in OpenBSD

reasonablePrivacy · Dec 5, 2019

https://www.openwall.com/lists/oss-security/2019/12/04/5
4 Dec 2019 20:49:22 +0000

CVE-2019-19521: Authentication bypass
1.1. Analysis
1.2. Case study: smtpd
1.3. Case study: ldapd
1.4. Case study: radiusd
1.5. Case study: sshd
1.6. Case study: su
2. CVE-2019-19520: Local privilege escalation via xlock
3. CVE-2019-19522: Local privilege escalation via S/Key and YubiKey
4. CVE-2019-19519: Local privilege escalation via su
5. Acknowledgments

==============================================================================
1. CVE-2019-19521: Authentication bypass
==============================================================================

We discovered an authentication-bypass vulnerability in OpenBSD's
authentication system: this vulnerability is remotely exploitable in
smtpd, ldapd, and radiusd, but its real-world impact should be studied
on a case-by-case basis. For example, sshd is not exploitable thanks to
its defense-in-depth mechanisms.
Click to expand...

https://twitter.com/reykfloeter/status/1202484458802294785

Reyk Flöter said:

In case that you‘ve missed it: upgrade your OpenBSD systems *now* – it’s as easy as running syspatch (or sysupgrade on -current).
Click to expand...

Log in or Sign up

Authentication vulnerabilities in OpenBSD

reasonablePrivacy Registered Member

Log in or Sign up

Authentication vulnerabilities in OpenBSD

reasonablePrivacy Registered Member

Useful Searches