PT-2019-6355 · Red Hat+5 · Sssd+6

Publicado 2019-01-15 · Atualizado 2024-06-15 · CVE-2019-3811

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:A/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions sssd versions prior to 2.1

Description A vulnerability was found in sssd where it returns '/' (the root directory) instead of '' (the empty string / no home directory) when a user is configured with no home directory set. This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. The vulnerability is related to information disclosure, allowing an attacker to access the file system.

Recommendations For versions prior to 2.1, update to version 2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the root directory to minimize the risk of exploitation.

Correção

Files Accessible to External Parties

Information Disclosure

Enumeração de Fraquezas

CWE-552

CWE-200

Identificadores relacionados

ALT-PU-2019-1550

BDU:2023-03476

CESA-2019_2177

CVE-2019-3811

DLA-1635-1

DLA-3436-1

MGASA-2019-0152

OPENSUSE-SU-2019:0344-1

OPENSUSE-SU-2019_0344-1

OPENSUSE-SU-2019_1174-1

OPENSUSE-SU-2024:13446-1

RHSA-2019:2177

RHSA-2019_2177

SUSE-SU-2019:0542-1

SUSE-SU-2019:0552-1

SUSE-SU-2019:0556-1

SUSE-SU-2019:0805-1

SUSE-SU-2019_0542-1

SUSE-SU-2019_0552-1

SUSE-SU-2019_0805-1

USN-5067-1

Produtos afetados

Alt Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

Sssd

Referências · 60

• https://nvd.nist.gov/vuln/detail/CVE-2019-3811 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-3811 · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20230525SE16MD · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-3436-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1087320 · Nota
• https://bugzilla.suse.com/977224 · Nota
• https://ubuntu.com/security/CVE-2019-3811 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00026.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:2177 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00045.html · Aviso do Fabricante
• https://bugzilla.suse.com/1120852 · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-3811 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2019/01/msg00011.html · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/NT6ZEFQ4B6JZKL6AAQC6N4XDZ2JOD7Z3/#NT6ZEFQ4B6JZKL6AAQC6N4XDZ2JOD7Z3 · Nota
• https://advisories.mageia.org/MGASA-2019-0152.html · Nota de Segurança