Re: [OATH-Toolkit-help] libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file?

[Ilkka Virta]

On 16.12.2013 22:43, Simon Josefsson wrote:
> Thanks for the report and looking into this issue.  Alas the timing
> here was bad, and I am just returning from vacation and must finish
> several things before season holidays -- if someone has worked out a
> patch and can do testing that it works and solves the problem I can
> review and apply and release it.   Ilkka, how much have you tested your
> patch?

That one was more like a rough sketch... (iow, I didn't)

The attached one seems to work for me:

--- usersfile before:
#HOTP   nobody  -       00      1       812658  2013-12-21T19:40:21L
# HOTP  nobody  -       11
HOTP    someone -       22
HOTP    nobody  -       1234
HOTP    nobody  -       33
---

- authenticate with OTP=158134 (key 1234, counter 4) -> accepted.
- retry with the same OTP -> denied, as expected.

--- usersfile after:
#HOTP   nobody  -       00      1       812658  2013-12-21T19:40:21L
# HOTP  nobody  -       11
HOTP    someone -       22
HOTP    nobody  -       1234    4       158134  2013-12-21T19:40:57L
HOTP    nobody  -       33
---

I couldn't get back to this sooner, sorry.

liboath-usersfile-parse-type2.diff
Description: Text document