PT-2015-6836 · Red Hat+2 · Sssd+3

Martin Prpič · Published 2014-04-28 · Updated 2023-02-13 · CVE-2015-5292

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions System Security Services Daemon (SSSD) versions 1.10 through 1.13.0

Description The issue is related to a memory leak in the Privilege Attribute Certificate (PAC) responder plugin, which can be triggered by remote authenticated users through a large number of logins during Kerberos authentication, leading to a denial of service due to memory consumption.

Recommendations For versions 1.10 through 1.13.0, update to version 1.13.1 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2014-1550

ALT-PU-2015-1775

CESA-2015_2019

CESA-2015_2355

CVE-2015-5292

RHSA-2015:2019

RHSA-2015:2355

RHSA-2015_2019

RHSA-2015_2355

Affected Products

Alt Linux

Centos

Red Hat

Sssd

References · 40

• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169613.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-2355.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169597.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5292 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-5292 · Security Note
• https://linux.oracle.com/errata/ELSA-2015-2019.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5292 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-1550 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-1775 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-5292 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5292 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-2355.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169110.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5292 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-2019.html · Vendor Advisory