The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade oath-toolkit | Jul 30, 2024 | Mar 9, 2014 |
| Suse | — | Upgrade libpskc0Upgrade libpskc-develUpgrade liboath-develUpgrade liboath0Upgrade oath-toolkit-xml | Aug 9, 2024 | Mar 9, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub