A vulnerability, which was classified as critical, has been found in OpenBSD 6.6 (Operating System). Affected by this issue is some unknown processing of the component S-Key/Yubikey Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root.

The weakness was shared 12/05/2019. This vulnerability is handled as CVE-2019-19522. The attack needs to be approached locally. Required for exploitation is a simple authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/07/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-146683, VDB-146682 and VDB-146681 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Name

• OpenBSD

Version

• 6.6

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion