PT-2010-4423 · Red Hat · Sssd

Ted Brunell · Publicado 2010-08-30 · Atualizado 2017-08-17 · CVE-2010-2940

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SSSD version 1.3.0

Description The issue allows remote attackers to bypass authentication requirements by providing an empty password when LDAP authentication and anonymous bind are enabled. This is due to a problem in the auth send function.

Recommendations For SSSD version 1.3.0, consider disabling anonymous bind or restricting access to the LDAP authentication mechanism until a patch is available. As a temporary workaround, avoid using empty passwords in the affected auth send function.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2010-2940

Produtos afetados

Sssd

Referências · 7

• https://osv.dev/vulnerability/CVE-2010-2940 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2940 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=625189 · Nota
• http://secunia.com/advisories/41159 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2940 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61399 · Nota
• https://security-tracker.debian.org/tracker/CVE-2010-2940 · Aviso do Fabricante