Yubico Issues Security Advisory As 2FA Bypass Vulnerability Confirmed
www.forbes.com
Yubico security advisory confirms 2FA bypass vulnerability.LightRocket via Getty ImagesUpdate, Jan. 18, 2025: This story, originally published Jan. 17, now includes further information about CVE-2025-23013 and clarification from Yubico regarding the severity rating.Two-factor authentication has increasingly become a security essential over recent years, so when news of anything that can bypass those 2FA protections breaks, its not something you can ignore. Be that the perpetual hack attack facing Google users, malicious Chrome extensions, or they Rockstar bypass kit impacting Microsoft users. Now, Yubico has thrown its hat into the 2FA bypass ring with a security advisory that has confirmed a bypass vulnerability in a software module used to support logging in on Linux or macOS using a YubiKey or other FIDO authenticators. Heres what you need to know.Yubico 2FA Security Advisory YSA-2025-01Yubico is most likely the first name that comes to mind when you think about two-factor authentication hardware keys and other secure authentication solutions. And for good reason: it has been leading the market in the area of hardware key resources for about as long as I can remember, and Ive been in the cybersecurity business for multiple decades. So, when Yubico issues a security advisory, I tend to take notice and if you are a Yubico customer, so should you.Yubico security advisory reference YSA-2025-01 relates to a partial authentication bypass in the pam-u2f pluggable authentication module software package that can be deployed to support YubiKey on macOS or Linux platforms.According to the advisory, pam-u2f packages prior to version 1.3.1 are susceptible to a vulnerability that can enable an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user, Yubico explained, and, depending upon the configuration, the attacker may also need to know the users password.MORE FOR YOUYubico Details Example Attack ScenariosA key differentiator between scenarios is the location of the authfile, (the argument itself is called authfile) Yubico said, explaining that the path for the authfile is configured via an argument to pam-u2f in the PAM stack stored under /etc/pam or /etc/pam.d. Yubico has detailed some example scenarios involving the management of the authfile at the center of the issue, including:Where a user-managed authfile, stored in the user home directory, is combined with pam-u2f used as a single-factor authentication method and the nouserok option enabled, an attacker could either remove or corrupt the authfile and force the pam-u2f module to return PAM_SUCCESS. This would lead to local privilege escalation if the user is authorized to sudo, Yubico said.With a centrally managed authfile, where a file cannot be modified without elevated privileges, and assuming pam-u2f is used as a second-factor authentication method in combination with a user password, Yubico said, an attacker could attempt to memory-starve the system by allocating large amounts of memory, and triggering a memory allocation error within pam-u2f. If successful, the second factor would not be verified anymore during an authentication event.Yubico Said No YubiKey Hardware Impacted By 2FA Bypass IssueYubico confirmed that no hardware is impacted by this vulnerability, meaning that the issue does not affect any previous or current generation YubiKey Series, YubiKey FIPS Series, Security Key Series, YubiHSM or YubiHSM FIPS devices.Yubico CVE-2025-23013 Vulnerability ExplainedThe vulnerability in question, CVE-2025-23013, is classified as high-severity and means that in certain scenarios when memory cannot be allocated or the module cannot change privileges it does not contribute to the final authentication decision performed by PAM. What this means is that a second or primary authentication factor, depending on the specific use case, would no longer be verified. A key differentiator between scenarios is the location of the authfile, Yubico said,.Yubico recommends that affected customers upgrade to the latest version of pam-u2f either by directly downloading from GitHub or getting the latest update via Yubico PPA.I reached out to Yubico for a statement. We can confirm that Yubico was informed by researchers that an issue was discovered in its open-source pam-u2f software package, a Yubico spokesperson said, this software issue does not impact YubiKeys or YubiHSMs.
0 Comments
·0 Shares
·9 Views