PT-2001-2573 · Opie · One-Time Passwords In Everything

Published 2001-12-31 · Updated 2024-02-14 · CVE-2001-1483

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions One-Time Passwords In Everything (a.k.a OPIE) versions 2.32 through 2.4

Description The issue allows remote attackers to determine the existence of user accounts. This is achieved by the system printing random passphrases if the user account does not exist and static passphrases if the user account does exist.

Recommendations For One-Time Passwords In Everything (a.k.a OPIE) versions 2.32 through 2.4, consider implementing additional authentication measures to prevent attackers from determining user account existence. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2001-1483

Affected Products

One-Time Passwords In Everything

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2001-1483 · Security Note
• http://securityfocus.com/archive/1/20011115221226.7C93E186B0%40atlas.dgp.toronto.edu · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7572 · Note
• http://securityfocus.com/bid/3549 · Note