PT-2014-3555 · Red Hat+2 · Sssd+2

Published 2014-06-11 · Updated 2024-06-15 · CVE-2014-0249

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SSSD version 1.11.6

Description The issue arises from the System Security Services Daemon (SSSD) not properly identifying group membership when a non-POSIX group is in a group membership chain. This allows local users to bypass access restrictions.

Recommendations For SSSD version 1.11.6, update to a version that properly handles group membership to prevent access restriction bypass.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2014-1995

CVE-2014-0249

OPENSUSE-SU-2024:10427-1

SUSE-SU-2016:2579-1

SUSE-SU-2016_2579-1

Affected Products

Alt Linux

Sssd

Suse

References · 28

• https://osv.dev/vulnerability/CVE-2014-0249 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-1995 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0249 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10427-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-0249 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:2579-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0249 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0249 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0249 · Security Note
• https://ubuntu.com/security/CVE-2014-0249 · Vendor Advisory
• https://suse.com/security/cve/CVE-2013-0220 · Note
• https://lists.suse.com/pipermail/sle-security-updates/2016-October/002342.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1101751 · Note
• https://suse.com/security/cve/CVE-2011-1758 · Note