Vulnerability in Bell Communications Research S Key
CVE-2001-1169
keyinit in S/Key does not require authentication to initialize a one-time password sequence, which allows an attacker who has gained privileges to a user account to create new one-time passwords for use in other activities that may use S/Key authentication, such as sudo.
EPSS: 0.012 (64.8th percentile) — read the EPSS interpretation.
Affected products
- Bell_communications_research S_key — versions gold
- N/a — versions n/a
References
- cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_BUGTRAQ, Patch)