CVE-2019-19522

Name of the Vulnerable Software and Affected Versions OpenBSD version 6.6

Description The issue allows local users to gain root access in a specific non-default configuration where S/Key or YubiKey authentication is enabled. This is possible because a user can write to the /etc/skey or /var/db/yubikey file, which does not require ownership by root, by leveraging membership in the auth group.

Recommendations For OpenBSD version 6.6, ensure that the /etc/skey and /var/db/yubikey files are properly secured and owned by root to prevent unauthorized access. Consider disabling S/Key or YubiKey authentication for non-root users or restricting membership in the auth group as a temporary mitigation measure.