Re: [OATH-Toolkit-help] libpam-oath vulnerable to replay of OTP as result of incorrectly parsing comments in users file?

[Bas van Schaik]

On 12/02/14 02:16, Simon Josefsson wrote:

I think it looked fine but I haven't fully analyzed it -- any chance
someone could come up with a brief description of how to reproduce the
problem exactly?  Then I could add that recipe as a self-test in the
package, apply the fix, and if that silences the self-test, I'm happy.

I think my first email (9 Dec 11:31 GMT) contains a fairly detailed description of how to reproduce this behaviour. Please let me know if you need additional info.

Thanks,

  Bas