PT-2011-3353 · Red Hat · Sssd

Vincent Danen · Publicado 2011-05-26 · Atualizado 2024-06-15 · CVE-2011-1758

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SSSD versions 1.5.x through 1.5.6

Description The issue allows local users to bypass Kerberos authentication. This is possible because the krb5 save ccname done function uses a pathname string as a password when automatic ticket renewal and offline authentication are configured. A local user can list the /tmp directory to obtain the pathname, which can then be used to bypass authentication.

Recommendations For SSSD versions 1.5.x through 1.5.6, update to version 1.5.7 or later to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2011-1758

OPENSUSE-SU-2024:10427-1

Produtos afetados

Sssd

Referências · 17

• https://bugzilla.redhat.com/show_bug.cgi?id=700891 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10427-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-0219 · Nota
• https://suse.com/security/cve/CVE-2013-0287 · Nota
• https://fedorahosted.org/sssd/ticket/856 · Correção
• http://openwall.com/lists/oss-security/2011/04/29/4 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2011-1758 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059619.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-1758 · Nota
• https://fedorahosted.org/pipermail/sssd-devel/2011-April/006138.html · Correção
• https://suse.com/security/cve/CVE-2010-4341 · Nota
• http://git.fedorahosted.org/git/?p=sssd.git%3Ba=commit%3Bh=fffdae81651b460f3d2c119c56d5caa09b4de42a · Nota
• https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.7 · Nota
• https://suse.com/security/cve/CVE-2014-0249 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=700867 · Correção