CVE-2019-19522: High severity openbsd vulnerability
OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this OpenBSD vulnerability?
The vulnerability ID for this OpenBSD vulnerability is CVE-2019-19522.
What is the severity rating of CVE-2019-19522?
CVE-2019-19522 has a severity rating of 7.8, which is considered high.
How can local users exploit CVE-2019-19522 to gain root access?
Local users can exploit CVE-2019-19522 to gain root access by leveraging membership in the auth group and writing to root's file in either /etc/skey or /var/db/yubikey.
Is OpenBSD 6.6 the only affected version by this vulnerability?
Yes, OpenBSD 6.6 is the only affected version by this vulnerability.
Where can I find more information about CVE-2019-19522 and its impact?
You can find more information about CVE-2019-19522 and its impact in the following references: [Link 1](http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html), [Link 2](http://seclists.org/fulldisclosure/2019/Dec/14), [Link 3](http://www.openwall.com/lists/oss-security/2019/12/04/5)