CVSS: 5.2EPSS: 0%CPEs: 6EXPL: 0CVE-2019-3811 – sssd: fallback_homedir returns '/' for empty home directories in passwd file
https://notcve.org/view.php?id=CVE-2019-3811
A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable. Se ha encontrado una vulnerabilidad en sssd. • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00026.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00045.html http://www.securityfocus.com/bid/106644 https://access.redhat.com/errata/RHSA-2019:2177 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3811 https://lists.debian.org/debian-lts-announce/2019/01/msg00011.html https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html https://access.redhat.com/security/cve/CVE-2019-3811 htt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-10852 – sssd: information leak from the sssd-sudo responder
https://notcve.org/view.php?id=CVE-2018-10852
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3. El pipe de Unix que utiliza sudo para contactar SSSD y leer las reglas sudo disponibles desde SSSD tiene permisos demasiado laxos, lo que significa que cualquiera que pueda enviar un mensaje utilizando el mismo protocolo raw que utilizan sudo y SSSD puede leer reglas sudo disponibles para cualquier usuario. Esto afecta a las versiones SSSD en versiones anteriores a la 1.16.3. The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. • http://www.securityfocus.com/bid/104547 https://access.redhat.com/errata/RHSA-2018:3158 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10852 https://lists.debian.org/debian-lts-announce/2018/07/msg00019.html https://access.redhat.com/security/cve/CVE-2018-10852 https://bugzilla.redhat.com/show_bug.cgi?id=1588810 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2017-12173 – sssd: unsanitized input when searching in local cache database
https://notcve.org/view.php?id=CVE-2017-12173
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it. Se ha encontrado que la función sysdb_search_user_by_upn_res() de sssd en versiones anteriores a la 1.16.0 no saneaba las peticiones al consultar su caché local y era vulnerable a inyecciones. En un entorno de inicio de sesión centralizado, si un hash de contraseña se almacenaba en la caché local de un usuario determinado, un atacante autenticado podía utilizar este error para recuperarlo. It was found that sssd's sysdb_search_user_by_upn_res() function did not sanitize requests when querying its local cache and was vulnerable to injection. • https://access.redhat.com/errata/RHSA-2017:3379 https://access.redhat.com/errata/RHSA-2018:1877 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12173 https://access.redhat.com/security/cve/CVE-2017-12173 https://bugzilla.redhat.com/show_bug.cgi?id=1498173 • CWE-20: Improper Input Validation CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.7EPSS: 0%CPEs: 78EXPL: 0CVE-2013-0219 – sssd: TOCTOU race conditions by copying and removing directory trees
https://notcve.org/view.php?id=CVE-2013-0219
System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files. System Security Services Daemon (SSSD) anterior a v1.9.4, cuando (1) se crea, (2) copia, o (3) elimina el directorio home de usuario, permite a usuarios locales crear, modificar o eliminar ficheros arbitrarios mediante un ataque de enlace simbólicos sobre otros ficheros del usuario. • http://git.fedorahosted.org/cgit/sssd.git/commit/?id=020bf88fd1c5bdac8fc671b37c7118f5378c7047 http://git.fedorahosted.org/cgit/sssd.git/commit/?id=3843b284cd3e8f88327772ebebc7249990fd87b9 http://git.fedorahosted.org/cgit/sssd.git/commit/?id=94cbf1cfb0f88c967f1fb0a4cf23723148868e4a http://git.fedorahosted.org/cgit/sssd.git/commit/?id=e864d914a44a37016736554e9257c06b18c57d37 http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098434.html http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098613.html http: • CWE-264: Permissions, Privileges, and Access Controls CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 5.0EPSS: 4%CPEs: 76EXPL: 0CVE-2013-0220 – sssd: Out-of-bounds read flaws in autofs and ssh services responders
https://notcve.org/view.php?id=CVE-2013-0220
The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet. La función (1) sss_autofs_cmd_getautomntent y (2) sss_autofs_cmd_getautomntbyname en responder/autofs/autofssrv_cmd.c y la función (3) ssh_cmd_parse_request en responder/ssh/sshsrv_cmd.c en System Security Services Daemon (SSSD) anterior a v1.9.4 permite a atacantes remotos generar una denegación de servicio (lectura fuera de los límites, caída y reinicio) mediante una paquete SSSD especialmente diseñado. • http://git.fedorahosted.org/cgit/sssd.git/commit/?id=2bd514cfde1938b1e245af11c9b548d58d49b325 http://git.fedorahosted.org/cgit/sssd.git/commit/?id=30e2585dd46b62aa3a4abdf6de3f40a20e1743ab http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098434.html http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098613.html http://rhn.redhat.com/errata/RHSA-2013-0508.html http://secunia.com/advisories/51928 http://secunia.com/advisories/52315 http://www.securityfocus.com/bid/57539 http • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •