CVE-2010-4341

sssd: DoS in sssd PAM responder can prevent logins

Severity Score

2.1

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service (infinite loop, crash, and login prevention) via a crafted packet.

La función pam_parse_in_data_v2 en src/responder/pam/pamsrv_cmd.c en el PAM responder en SSSD v.1.5.0, v.1.4.x, y v.1.3 permite a usuarios locales provocar una denegación de servicio (bucle infinito, caída, y prevención de login) a través de paquetes manipulados.

*Credits: N/A

CVSS Scores

NISTv2 2.1

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-11-30 CVE Reserved
2011-01-25 CVE Published
2023-03-08 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-399: Resource Management Errors

CAPEC

References (14)

URL	Tag	Source
http://secunia.com/advisories/43068	Third Party Advisory
http://www.securityfocus.com/bid/45961	Vdb Entry
http://www.vupen.com/english/advisories/2011/0212	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/64881	Vdb Entry

URL	Date	SRC

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053319.html	2017-08-17
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053337.html	2017-08-17
https://bugzilla.redhat.com/show_bug.cgi?id=661163	2011-07-21

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html	2017-08-17
http://secunia.com/advisories/43053	2017-08-17
http://secunia.com/advisories/43055	2017-08-17
http://www.redhat.com/support/errata/RHSA-2011-0560.html	2017-08-17
http://www.redhat.com/support/errata/RHSA-2011-0975.html	2017-08-17
http://www.vupen.com/english/advisories/2011/0197	2017-08-17
https://access.redhat.com/security/cve/CVE-2010-4341	2011-07-21

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Fedorahosted Search vendor "Fedorahosted"		Sssd Search vendor "Fedorahosted" for product "Sssd"				1.4.0 Search vendor "Fedorahosted" for product "Sssd" and version "1.4.0"		-		Affected
Fedorahosted Search vendor "Fedorahosted"		Sssd Search vendor "Fedorahosted" for product "Sssd"				1.4.1 Search vendor "Fedorahosted" for product "Sssd" and version "1.4.1"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Sssd Search vendor "Fedoraproject" for product "Sssd"				1.3.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.3.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Sssd Search vendor "Fedoraproject" for product "Sssd"				1.5.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.0"		-		Affected