Oh, wow, this is brutal. They're shelling out to a command line program to do authentication, and not catching the "-" metacharacter in the username they shell out with, so you can pass options to that program.
It just goes to show, as a user you can make informed choices in what software to use to reduce your security exposure, but that's not enough. You still need to pay attention to new problems that might pop up. No software is guaranteed to be safe in perpetuity.
Is there some technical reason OpenBSD doesn't do this?
Here's the link to his website: https://cr.yp.to/djb.html
Seriously, how many other people make contributions in areas ranging all the way from number theory to hand-written machine code?
starting with binary compatibility
with Linux and a lot of legacy stuff
which came from NetBSD and BSD 4.4 lite/BSD 4.3.
You described OpenBSD with that comment.
- Xenocara with rootless privileges as a fork of X
- LibreSSL
- Linux compat going away
- Pledge/Unveil
- Some daemons belonging to ports
- HTTPD/SMTPD and so on as replacement of bloated daemons
- OpenSSH itself
- Retguard
This vulnerability is bad, but pledge
and unveil will have even
more prominent roles in base soon, so even
if you get privs, you can do either nil or just crash because of pledge.
Interesting to track who exactly "they" might have been, as many commenters are saying this is uncharacteristic for OpenBSD.
Looking at the patch, the first OpenBSD commit of this file [1] is from 2000 and says "from BSDI" in the commit message, did fork()+execve() at that time, and the BSDI copyright comment says 1995-1997.
Probable to say more recent OpenBSD stuff is likely not written this way, but that they have baggage like this in the tree from earlier times.
[1] https://cvsweb.openbsd.org/src/lib/libc/gen/auth_subr.c?rev=...
edited: make verb plural.