PT-2010-4423 · Red Hat · Sssd

Ted Brunell · Published 2010-08-30 · Updated 2017-08-17 · CVE-2010-2940

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SSSD version 1.3.0

Description The issue allows remote attackers to bypass authentication requirements by providing an empty password when LDAP authentication and anonymous bind are enabled. This is due to a problem in the auth send function.

Recommendations For SSSD version 1.3.0, consider disabling anonymous bind or restricting access to the LDAP authentication mechanism until a patch is available. As a temporary workaround, avoid using empty passwords in the affected auth send function.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-2940

Affected Products

Sssd

References · 7

• https://osv.dev/vulnerability/CVE-2010-2940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2940 · Security Note
• http://secunia.com/advisories/41159 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2940 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2940 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=625189 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61399 · Note