PT-2011-1510 · Red Hat · Sssd+1

Sebastian Krahmer · Publicado 2011-01-25 · Atualizado 2024-06-15 · CVE-2010-4341

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions SSSD versions 1.3 through 1.5.0 SSSD version 1.4.x

Description The issue allows local users to cause a denial of service, resulting in an infinite loop, crash, and prevention of login, via a crafted packet. This is due to a problem in the pam parse in data v2 function.

Recommendations For SSSD versions 1.3 through 1.5.0, consider disabling the pam parse in data v2 function as a temporary workaround until a patch is available. For SSSD version 1.4.x, restrict access to the PAM responder to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2010-4341

OPENSUSE-SU-2024:10427-1

RHSA-2011:0560

RHSA-2011:0975

RHSA-2011_0560

RHSA-2011_0975

Produtos afetados

Red Hat

Sssd

Referências · 28

• https://suse.com/security/cve/CVE-2013-0220 · Nota
• http://secunia.com/advisories/43055 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0212 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10427-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-1758 · Nota
• http://secunia.com/advisories/43053 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4341 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-0287 · Nota
• https://linux.oracle.com/errata/ELSA-2011-0560.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-4341 · Nota
• https://osv.dev/vulnerability/CVE-2010-4341 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2011:0560 · Nota
• http://redhat.com/support/errata/RHSA-2011-0975.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-0249 · Nota
• https://security-tracker.debian.org/tracker/CVE-2010-4341 · Aviso do Fabricante