Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
OATH Toolkit 安全漏洞
Vulnerability Description
OATH Toolkit是一套用于开发OATH（开放身份认证规范）相关部署技术的工具集，它通过集成共享库、命令行工具和PAM模块，可生成一次性密码认证系统，且支持基于事件的HOTP和基于时间的TOTP的一次性密码设置。 OATH Toolkit 2.4.1之前版本的liboath中的usersfile.c文件存在安全漏洞，该漏洞源于程序没有正确处理包含无效的one-time-password (OTP)类型的注释行和/etc/users.oath文件中的用户名。当验证OTP时，攻击者可利用该漏洞实施重放攻
CVSS Information
N/A
Vulnerability Type
N/A