PT-2013-1187 · Red Hat+1 · Sssd+2

Kaushik Banerjee · Published 2013-03-19 · Updated 2024-06-15 · CVE-2013-0287

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SSSD versions 1.9.0 through 1.9.4 sssd version 1.9.2 sssd-client version 1.9.2 sssd-tools version 1.9.2 libipa hbac version 1.9.2 libipa hbac-devel version 1.9.2 libsss sudo version 1.9.2 libsss sudo-devel version 1.9.2 libipa hbac-python version 1.9.2 libsss idmap version 1.9.2 libsss idmap-devel version 1.9.2 libsss autofs version 1.9.2 sssd-debuginfo version 1.9.2

Description The vulnerability may lead to a breach of confidentiality and integrity of protected information. It can be exploited remotely by an attacker who has passed the authentication procedure. The Simple Access Provider in System Security Services Daemon (SSSD) does not properly enforce the simple deny groups option when the Active Directory provider is used, allowing remote authenticated users to bypass intended access restrictions.

Recommendations For SSSD versions 1.9.0 through 1.9.4, update to a version that properly enforces the simple deny groups option. For sssd version 1.9.2, consider disabling the vulnerable component until a patch is available. For sssd-client version 1.9.2, restrict access to the vulnerable module to minimize the risk of exploitation. For sssd-tools version 1.9.2, avoid using the vulnerable tool until the issue is resolved. For libipa hbac version 1.9.2, libipa hbac-devel version 1.9.2, libsss sudo version 1.9.2, libsss sudo-devel version 1.9.2, libipa hbac-python version 1.9.2, libsss idmap version 1.9.2, libsss idmap-devel version 1.9.2, libsss autofs version 1.9.2, and sssd-debuginfo version 1.9.2, update to a version that contains a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability for some of the affected packages.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-07147

BDU:2015-07148

BDU:2015-07149

BDU:2015-07150

BDU:2015-07151

BDU:2015-07152

BDU:2015-07153

BDU:2015-07154

BDU:2015-07160

BDU:2015-07161

BDU:2015-07162

BDU:2015-07163

BDU:2015-08958

BDU:2015-08959

BDU:2015-08960

BDU:2015-08961

CESA-2013_0663

CVE-2013-0287

OPENSUSE-SU-2024:10427-1

RHSA-2013:0663

RHSA-2013_0663

Affected Products

Centos

Red Hat

Sssd

References · 54

• http://lists.opensuse.org/opensuse-updates/2013-03/msg00115.html · Vendor Advisory
• http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6569d57e3bc168e6e83d70333b48c5cb43aa04c4 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0287 · Security Note
• https://bdu.fstec.ru/vul/2015-07153 · Security Note
• https://bdu.fstec.ru/vul/2015-07154 · Security Note
• http://git.fedorahosted.org/cgit/sssd.git/patch/?id=26590d31f492dbbd36be6d0bde46a4bd3b221edb · Patch
• https://ubuntu.com/security/CVE-2013-0287 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07162 · Security Note
• http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6837eee3f7f81c0ee454d3718d67d7f3cc6b48ef · Patch
• https://bdu.fstec.ru/vul/2015-07149 · Security Note
• http://git.fedorahosted.org/cgit/sssd.git/patch/?id=7619be9f6bf649665fcbeee9e6b120f9f9cba2a5 · Patch
• https://bdu.fstec.ru/vul/2015-07151 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-0287 · Security Note
• http://git.fedorahosted.org/cgit/sssd.git/patch/?id=c0bca1722d6f9dfb654ad78397be70f79ff39af1 · Patch
• https://bdu.fstec.ru/vul/2015-07163 · Security Note