CVE-2013-7322
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an...
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
Exploit likelihood
What each source reports
NVD Score used
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
- Record
CVE-2013-7322- CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
- Record
CVE-2013-7322- Updated
- 2026-11-02
EUVDEUVD-2013-7098 No score
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
- Record
EUVD-2013-7098- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2xxx-v399-cp66 No score
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an...
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
- Record
GHSA-2xxx-v399-cp66- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
- Record
CVE-2013-7322- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-7322 No score
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
- Record
DEBIAN-CVE-2013-7322- Updated
- 2026-11-02
OSVMGASA-2014-0101 No score
Updated oath-toolkit packages fix security vulnerability
It was found that comments (lines starting with a hash) in /etc/users.oath could prevent one-time-passwords (OTP) from being invalidated, leaving the OTP vulnerable to replay attacks (CVE-2013-7322).
- Record
MGASA-2014-0101- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11104-1 No score
liboath-devel-2.6.7-1.3 on GA media
These are all security issues fixed in the liboath-devel-2.6.7-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11104-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-7322 No score
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
- Record
UBUNTU-CVE-2013-7322- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
oath-toolkitDebian:12 |
before 2.4.1-1 | 2.4.1-1 |
oath-toolkitDebian:13 |
before 2.4.1-1 | 2.4.1-1 |
oath-toolkitDebian:14 |
before 2.4.1-1 | 2.4.1-1 |
oath-toolkitMageia:3 |
before 1.12.6-2.1.mga3 | 1.12.6-2.1.mga3 |
oath-toolkitMageia:4 |
before 2.4.1-1.mga4 | 2.4.1-1.mga4 |
oath-toolkitopenSUSE:Tumbleweed |
before 2.6.7-1.3 | 2.6.7-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-7322 is a medium vulnerability (CVSS 4.9) in Nongnu Oath Toolkit, published February 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in oath-toolkit 2.4.1-1.
References
seclists.org/oss-sec/2014/q1/296
lists.nongnu.org/archive/html/oath-toolkit-help/2013-12/msg00003.html
exchange.xforce.ibmcloud.com/vulnerabilities/91316
nongnu.org/oath-toolkit/NEWS.html
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-7322
github.com/advisories/GHSA-2xxx-v399-cp66
security-tracker.debian.org/tracker/CVE-2013-7322
advisories.mageia.org/MGASA-2014-0101.html
bugs.mageia.org/show_bug.cgi?id=12873
lists.fedoraproject.org/pipermail/package-announce/2014-February/128934.html
ubuntu.com/security/CVE-2013-7322
cve.org/CVERecord?id=CVE-2013-7322
suse.com/security/cve/CVE-2013-7322