Qualys Labs experts have discovered several security issues related to the ability to trick programs responsible for implementing password checking mechanisms in BSD (similar to PAM). The trick lies in passing the username "-schallenge" or "-schallenge:passwd", which is then interpreted not as a username, but as an option. After that, the system accepts any password. Vulnerable services, which ultimately allow unauthorized access, include smtpd, ldapd, and radiusd. The sshd service cannot be exploited since it recognizes that the user "-schallenge" does not actually exist. The su program crashes when an attempt is made to exploit it directly as it also tries to determine the uid of a non-existent user.
There were also various vulnerabilities disclosed in xlock, in authentication through S/K and Yubikey, as well as in su, which are not related to specifying the user "-schallenge". The vulnerability in xlock allows a regular user to escalate privileges to the auth group. Due to improper functioning of the authentication mechanisms through S/K and Yubikey, privileges can be escalated from the auth group to the root user, but in the default configuration of OpenBSD, this does not work since authentication through S/K and Yubikey is disabled. Finally, the vulnerability in su allows a user to increase system resource limits, such as the number of open file descriptors.
At this time, the vulnerabilities have been addressed, and security updates are available through the standard syspatch(8) mechanism.
Source: linux.org.ru
