FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-1283

This CVE name corresponds to:

Entered	Topic
2006-03-24	OPIE -- arbitrary password change

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-1283 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-1283
Phase	Assigned(20060319)

Description

opiepasswd in One-Time Passwords in Everything (OPIE) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322 uses the getlogin function to determine the invoking user account, which might allow local users to configure OPIE access to the root account and possibly gain root privileges if a root shell is permitted by the configuration of the wheel group or sshd.

References

Source	Reference
FREEBSD	FreeBSD-SA-06:12
BID	17194
VUPEN	ADV-2006-1074
OSVDB	24067
SECTRACK	1015817
SECUNIA	19347
XF	bsd-opie-unauthorized-privileges(25397)