Description
opiepasswd in One-Time Passwords in Everything (OPIE) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322 uses the getlogin function to determine the invoking user account, which might allow local users to configure OPIE access to the root account and possibly gain root privileges if a root shell is permitted by the configuration of the wheel group or sshd.
References (7)
Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/25397
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1015817
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/17194
Patch, Vendor Advisory vendor-advisory
x_refsource_freebsd
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:12.opie.asc
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/19347
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/24067
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/1074
Scores
EPSS
0.0005
EPSS Percentile
16.8%
Details
Status
published
Products (33)
freebsd/freebsd
1.1.5.1
freebsd/freebsd
2.0
freebsd/freebsd
2.0.5
freebsd/freebsd
2.1 stable
freebsd/freebsd
2.1.0
freebsd/freebsd
2.1.5
freebsd/freebsd
2.1.6
freebsd/freebsd
2.1.6.1
freebsd/freebsd
2.1.7
freebsd/freebsd
2.1.7.1
... and 23 more
Published
Mar 23, 2006
Tracked Since
Feb 18, 2026