Description
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | oath-toolkit | 2.4.1-1 | — |
| Debian 13 | oath-toolkit | 2.4.1-1 | — |
| Debian 12 | oath-toolkit | 2.4.1-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | oath-toolkit | 2.6.7-1.3 | openSUSE-SU-2024:11104-1 |
Advisories 1
- openSUSE-SU-2024:11104-1 liboath-devel-2.6.7-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20140209 Re: oath-toolkit PAM module OTP token invalidation issue mailing-list
- [OATH-Toolkit-help] 20131214 Re: libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file? mailing-list
- [OATH-Toolkit-help] 20131209 libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file? mailing-list
- oath-toolkit-cve20137322-replay(91316) vdb-entry
- [OATH-Toolkit-help] 20131214 Re: libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file? mailing-list
- http://www.nongnu.org/oath-toolkit/NEWS.html