Hello Everyone,
One of my tasks at work was to remove OPIE and its related libraries from o=
ur kernel. OPIE (One-time Passwords In Everything) was related to a potenti=
al remote arbitrary code execution bug (http://web.nvd.nist.gov/view/vuln/d=
etail?vulnId=3DCVE-2010-1938 ) back in 2010.
We've been looking into this library and have decided that it isn't necessa=
ry for our operations, and poses an unnecessary risk and potential attack v=
ector. I've written a kernel patch that includes a compilation flag for opi=
e support which determines whether or not to build the opie executables, an=
d have added guards to a few source files so that they will still build wit=
hout having the opie libraries.
My question is this: With PAM becoming the standard method for user-based a=
uthentication, is it still necessary to have OPIE as a separate set of libr=
aries, executables, and built into the telnet and ftp servers?
Zak Blacher
Software Developer Intern
Sandvine Corporation
www.sandvine.com<http://www.sandvine.com>
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"