CVE-2013-7322: Medium severity nongnu Oath Toolkit vulnerability
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OATH Toolkit (liboath)to a version that resolves this vulnerability.Fixed in 2.4.1 - Compensating control
If you cannot upgrade immediately, mitigate replay attacks by preventing context-dependent attackers from accessing the environment where libpam-oath/liboath is used (e.g., restrict access to the authentication workflow and /etc/users.oath so only trusted principals can influence requests).
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7322?
CVE-2013-7322 has a medium severity level, which can lead to replay attacks under certain conditions.
How do I fix CVE-2013-7322?
To fix CVE-2013-7322, you should upgrade to OATH Toolkit version 2.4.1 or later where the vulnerability has been addressed.
What types of attacks can CVE-2013-7322 enable?
CVE-2013-7322 can enable attackers to conduct context-dependent replay attacks by mismanaging one-time-passwords.
Which versions of OATH Toolkit are affected by CVE-2013-7322?
CVE-2013-7322 affects all versions of OATH Toolkit prior to 2.4.1.
Is CVE-2013-7322 a hardware or software vulnerability?
CVE-2013-7322 is a software vulnerability found in the OATH Toolkit specifically in the usersfile.c component.