Published: 05/12/2019 Updated: 12/12/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c and gen/authenticate.c in libc (and login/login.c and xenocara/app/xenodm/greeter/verify.c).

Vulnerable Product	Search on Vulmon	Subscribe to Product
openbsd openbsd 6.6

Qualys has discovered that OpenBSD suffers from multiple authentication bypass and local privilege escalation vulnerabilities ...

Full Disclosure mailing list archives   By Date By Thread </form>    Authentication vulnerabilities in OpenBSD   From: Qualys Security ...

oss-sec mailing list archives   By Date By Thread </form>    Authentication vulnerabilities in OpenBSD   From: Qualys Security Advisor ...

Yet Another Link Repo. Mainly Security Links

Robs-Links Mostly Cybersecurity related, however not all Malware Related Link Description sslblabusech/ Malware related ssl certs githubcom/guardicore/monkey Infection Monkey - Automated testing urlhausabusech/ Malware Repo triage/reports/public Malware Repo Testing Disto Link Description testaspnetvulnwebc

CWE-287 https://www.openbsd.org/errata66.html https://www.openwall.com/lists/oss-security/2019/12/04/5 http://www.openwall.com/lists/oss-security/2019/12/04/6 http://www.openwall.com/lists/oss-security/2019/12/04/5 https://seclists.org/bugtraq/2019/Dec/8 http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html http://seclists.org/fulldisclosure/2019/Dec/14 https://nvd.nist.gov https://github.com/robmichel2854/robs-links http://seclists.org/fulldisclosure/2019/Dec/14

CVE-2019-19521

Vulnerability Summary

Vulnerability Trend

Exploits

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect