CVE-2006-1283
opiepasswd in One-Time Passwords in Everything (OPIE) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322 uses the getlogin function to determine the invoking user account, which might allow local users to configure OPIE access to the root…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
opiepasswd in One-Time Passwords in Everything (OPIE) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322 uses the getlogin function to determine the invoking user account, which might allow local users to configure OPIE access to the root account and possibly gain root privileges if a root shell is permitted by the configuration of the wheel group or sshd.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.37% probability · 30th percentile
- CISA KEV
- Not listed
- Affected
- freebsd/freebsd
- Source
- secteam@freebsd.org
References
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:12.opie.ascPatch, Vendor Advisory
- http://secunia.com/advisories/19347Vendor Advisory
- http://securitytracker.com/id?1015817
- http://www.osvdb.org/24067
- http://www.securityfocus.com/bid/17194Patch
- http://www.vupen.com/english/advisories/2006/1074Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25397
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:12.opie.ascPatch, Vendor Advisory
- http://secunia.com/advisories/19347Vendor Advisory
- http://securitytracker.com/id?1015817
- http://www.osvdb.org/24067
- http://www.securityfocus.com/bid/17194Patch
- http://www.vupen.com/english/advisories/2006/1074Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25397
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.