PT-2014-3555 · Red Hat+2 · Sssd+2

Publicado 2014-06-11 · Atualizado 2024-06-15 · CVE-2014-0249

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SSSD version 1.11.6

Description The issue arises from the System Security Services Daemon (SSSD) not properly identifying group membership when a non-POSIX group is in a group membership chain. This allows local users to bypass access restrictions.

Recommendations For SSSD version 1.11.6, update to a version that properly handles group membership to prevent access restriction bypass.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2014-1995

CVE-2014-0249

OPENSUSE-SU-2024:10427-1

SUSE-SU-2016:2579-1

SUSE-SU-2016_2579-1

Produtos afetados

Alt Linux

Sssd

Suse

Referências · 28

• https://suse.com/security/cve/CVE-2013-0220 · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2016-October/002342.html · Nota
• https://osv.dev/vulnerability/CVE-2014-0249 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2014-1995 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1101751 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0249 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:10427-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-0249 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2016:2579-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-1758 · Nota
• https://suse.com/security/cve/CVE-2014-0249.html · Nota
• https://suse.com/security/cve/CVE-2013-0287 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0249 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0249 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-0249 · Aviso do Fabricante