CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-16088
https://notcve.org/view.php?id=CVE-2020-16088
iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches. iked en OpenIKED, como es usado en OpenBSD versiones hasta 6.7, permite omitir una autenticación porque el archivo ca.c presenta una lógica equivocada para comprobar si una clave pública coincide • https://ftp.openbsd.org/pub/OpenBSD/patches/6.7/common/014_iked.patch.sig https://github.com/openbsd/src/commit/7afb2d41c6d373cf965285840b85c45011357115 https://github.com/xcllnt/openiked/commits/master https://www.openiked.org/security.html • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 6CVE-2019-19726 – OpenBSD Dynamic Loader chpass Privilege Escalation
https://notcve.org/view.php?id=CVE-2019-19726
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root. OpenBSD versiones hasta 6.6, permite a usuarios locales escalar a root porque una comprobación de LD_LIBRARY_PATH en los programas setuid puede ser vencida estableciendo un límite de recursos de RLIMIT_DATA muy pequeño. Al ejecutar chpass o passwd (que son root de setuid), en la función _dl_setup_env en el archivo ld.so intenta eliminar LD_LIBRARY_PATH del entorno, pero presenta un fallo cuando no puede asignar memoria. • https://www.exploit-db.com/exploits/47780 https://www.exploit-db.com/exploits/47803 http://packetstormsecurity.com/files/155658/Qualys-Security-Advisory-OpenBSD-Dynamic-Loader-Privilege-Escalation.html http://packetstormsecurity.com/files/155764/OpenBSD-Dynamic-Loader-chpass-Privilege-Escalation.html http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html http://seclists.org/fulldisclosure/2019/Dec/31 http://seclists.org/fulldisclosure/2023/Oct/11 http://www.openwall.com/lists/ • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 3CVE-2019-19519
https://notcve.org/view.php?id=CVE-2019-19519
In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in su/su.c. En OpenBSD versión 6.6, los usuarios locales pueden usar la opción su -L para lograr cualquier clase de inicio de sesión (a menudo excluyendo root) porque hay un bug en la función principal en el archivo su/su.c. • http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html http://seclists.org/fulldisclosure/2019/Dec/14 http://www.openwall.com/lists/oss-security/2019/12/04/5 https://github.com/openbsd/src/blob/2dfc98f42e117c7605b52b5020b630d98601dc22/usr.bin/su/su.c#L210-L211 https://seclists.org/bugtraq/2019/Dec/8 https://www.openbsd.org/errata66.html https://www.openwall.com/lists/oss-security/2019/12/04/5 • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 3CVE-2019-19520
https://notcve.org/view.php?id=CVE-2019-19520
xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen. xlock en OpenBSD versiones 6.6, permite a usuarios locales conseguir los privilegios del grupo de autenticación al proporcionar una variable de entorno LIBGL_DRIVERS_PATH, porque el archivo xenocara/lib/mesa/src/loader/loader.c maneja inapropiadamente dlopen. • http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html http://seclists.org/fulldisclosure/2019/Dec/14 http://www.openwall.com/lists/oss-security/2019/12/04/5 http://www.openwall.com/lists/oss-security/2019/12/04/6 https://seclists.org/bugtraq/2019/Dec/8 https://www.openbsd.org/errata66.html https://www.openwall.com/lists/oss-security/2019/12/04/5 • CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 3CVE-2019-19521
https://notcve.org/view.php?id=CVE-2019-19521
libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c and gen/authenticate.c in libc (and login/login.c and xenocara/app/xenodm/greeter/verify.c). libc en OpenBSD versión 6.6, permite omitir la autenticación por medio del nombre de usuario -schallenge, como es demostrado por smtpd, ldapd o radiusd. Esto está relacionado con los archivos gen/auth_subr.c y gen/authenticate.c en libc (y los archivos login/login.c y xenocara/app/xenodm/greeter/verify.c). • http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html http://seclists.org/fulldisclosure/2019/Dec/14 http://www.openwall.com/lists/oss-security/2019/12/04/5 http://www.openwall.com/lists/oss-security/2019/12/04/6 https://seclists.org/bugtraq/2019/Dec/8 https://www.openbsd.org/errata66.html https://www.openwall.com/lists/oss-security/2019/12/04/5 • CWE-287: Improper Authentication •