CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2013-0287 – sssd: simple access provider flaw prevents intended ACL use when client to an AD provider
https://notcve.org/view.php?id=CVE-2013-0287
21 Mar 2013 — The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions. El Simple Access Provider en System Security Services Daemon (SSSD) v1.9.0 hasta v1.9.4, cuando usa el proveedor de Active Directory, no se aplica correctamente la opción simple_deny_groups, lo que permite a usuarios remotos autenticados par... • http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=910938 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 78EXPL: 0CVE-2013-0219 – sssd: TOCTOU race conditions by copying and removing directory trees
https://notcve.org/view.php?id=CVE-2013-0219
24 Feb 2013 — System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files. System Security Services Daemon (SSSD) anterior a v1.9.4, cuando (1) se crea, (2) copia, o (3) elimina el directorio home de usuario, permite a usuarios locales crear, modificar o eliminar ficheros arbitrarios mediante un ataque de enlace simbólicos sobre otros ficheros de... • http://git.fedorahosted.org/cgit/sssd.git/commit/?id=020bf88fd1c5bdac8fc671b37c7118f5378c7047 • CWE-264: Permissions, Privileges, and Access Controls CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.5EPSS: 1%CPEs: 76EXPL: 0CVE-2013-0220 – sssd: Out-of-bounds read flaws in autofs and ssh services responders
https://notcve.org/view.php?id=CVE-2013-0220
24 Feb 2013 — The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet. La función (1) sss_autofs_cmd_getautomntent y (2) sss_autofs_cmd_getautomntbyname en responder/autofs/autofssrv_cmd.c y la función (3) ssh_cmd... • http://git.fedorahosted.org/cgit/sssd.git/commit/?id=2bd514cfde1938b1e245af11c9b548d58d49b325 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2011-1758
https://notcve.org/view.php?id=CVE-2011-1758
26 May 2011 — The krb5_save_ccname_done function in providers/krb5/krb5_auth.c in System Security Services Daemon (SSSD) 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by listing the /tmp directory to obtain the pathname. La función krb5_save_ccname_done en providers/krb5/krb5_auth.c en el Security Services Daemon (SSSD) v1.5.x anteriores a v1.5.7 1.5.x, cuando la renovación autom... • http://git.fedorahosted.org/git/?p=sssd.git%3Ba=commit%3Bh=fffdae81651b460f3d2c119c56d5caa09b4de42a • CWE-287: Improper Authentication •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2010-4341 – sssd: DoS in sssd PAM responder can prevent logins
https://notcve.org/view.php?id=CVE-2010-4341
25 Jan 2011 — The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service (infinite loop, crash, and login prevention) via a crafted packet. La función pam_parse_in_data_v2 en src/responder/pam/pamsrv_cmd.c en el PAM responder en SSSD v.1.5.0, v.1.4.x, y v.1.3 permite a usuarios locales provocar una denegación de servicio (bucle infinito, caída, y prevención de login) a través de paquetes manipulados. • http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053319.html • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2010-2940
https://notcve.org/view.php?id=CVE-2010-2940
30 Aug 2010 — The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pam_authenticate via an empty password. La función auth_send de providers/ldap/ldap_auth.c de System Security Services Daemon (SSSD) v1.3.0, si la autenticación LDAP y vinculaciones (bind) anónimas están activadas, permite a atacantes remotos evitar los requisitos de autenticación de... • http://secunia.com/advisories/41159 • CWE-287: Improper Authentication •
CVSS: 9.1EPSS: 0%CPEs: 15EXPL: 0CVE-2010-0014
https://notcve.org/view.php?id=CVE-2010-0014
14 Jan 2010 — System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting ticket (TGT); and might allow remote attackers to bypass intended access restrictions via vectors involving an arbitrary password in conjunction with a valid TGT. System Security Services Daemon (SSSD) anterior a v1... • http://secunia.com/advisories/38160 • CWE-287: Improper Authentication •