CVE-2013-0219
sssd: TOCTOU race conditions by copying and removing directory trees
Severity Score
5.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.
System Security Services Daemon (SSSD) anterior a v1.9.4, cuando (1) se crea, (2) copia, o (3) elimina el directorio home de usuario, permite a usuarios locales crear, modificar o eliminar ficheros arbitrarios mediante un ataque de enlace simbólicos sobre otros ficheros del usuario.
SSSD provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides NSS and PAM interfaces toward the system and a pluggable back end system to connect to multiple different account sources. A race condition was found in the way SSSD copied and removed user home directories. A local attacker who is able to write into the home directory of a different user who is being removed could use this flaw to perform symbolic link attacks, possibly allowing them to modify and delete arbitrary files with the privileges of the root user.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2012-12-06 CVE Reserved
- 2013-02-24 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CAPEC
References (15)
| URL | Tag | Source |
|---|---|---|
| http://git.fedorahosted.org/cgit/sssd.git/commit/?id=020bf88fd1c5bdac8fc671b37c7118f5378c7047 | X_refsource_confirm | |
| http://git.fedorahosted.org/cgit/sssd.git/commit/?id=3843b284cd3e8f88327772ebebc7249990fd87b9 | X_refsource_confirm | |
| http://git.fedorahosted.org/cgit/sssd.git/commit/?id=94cbf1cfb0f88c967f1fb0a4cf23723148868e4a | X_refsource_confirm | |
| http://git.fedorahosted.org/cgit/sssd.git/commit/?id=e864d914a44a37016736554e9257c06b18c57d37 | X_refsource_confirm | |
| http://www.securityfocus.com/bid/57539 | Vdb Entry | |
| https://fedorahosted.org/sssd/ticket/1782 | X_refsource_confirm | |
| https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | <= 1.9.3 Search vendor "Fedoraproject" for product "Sssd" and version " <= 1.9.3" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.2.1 Search vendor "Fedoraproject" for product "Sssd" and version "0.2.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.3.0 Search vendor "Fedoraproject" for product "Sssd" and version "0.3.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.3.1 Search vendor "Fedoraproject" for product "Sssd" and version "0.3.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.3.2 Search vendor "Fedoraproject" for product "Sssd" and version "0.3.2" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.3.3 Search vendor "Fedoraproject" for product "Sssd" and version "0.3.3" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.4.0 Search vendor "Fedoraproject" for product "Sssd" and version "0.4.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.4.1 Search vendor "Fedoraproject" for product "Sssd" and version "0.4.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.5.0 Search vendor "Fedoraproject" for product "Sssd" and version "0.5.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.6.0 Search vendor "Fedoraproject" for product "Sssd" and version "0.6.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.6.1 Search vendor "Fedoraproject" for product "Sssd" and version "0.6.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.7.0 Search vendor "Fedoraproject" for product "Sssd" and version "0.7.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.7.1 Search vendor "Fedoraproject" for product "Sssd" and version "0.7.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.99.0 Search vendor "Fedoraproject" for product "Sssd" and version "0.99.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 0.99.1 Search vendor "Fedoraproject" for product "Sssd" and version "0.99.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.0.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.0.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.0.1 Search vendor "Fedoraproject" for product "Sssd" and version "1.0.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.0.2 Search vendor "Fedoraproject" for product "Sssd" and version "1.0.2" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.0.3 Search vendor "Fedoraproject" for product "Sssd" and version "1.0.3" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.0.4 Search vendor "Fedoraproject" for product "Sssd" and version "1.0.4" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.0.5 Search vendor "Fedoraproject" for product "Sssd" and version "1.0.5" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.0.6 Search vendor "Fedoraproject" for product "Sssd" and version "1.0.6" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.0.99 Search vendor "Fedoraproject" for product "Sssd" and version "1.0.99" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.1.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.1.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.1.1 Search vendor "Fedoraproject" for product "Sssd" and version "1.1.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.1.2 Search vendor "Fedoraproject" for product "Sssd" and version "1.1.2" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.1.91 Search vendor "Fedoraproject" for product "Sssd" and version "1.1.91" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.1.92 Search vendor "Fedoraproject" for product "Sssd" and version "1.1.92" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.2.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.2.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.2.1 Search vendor "Fedoraproject" for product "Sssd" and version "1.2.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.2.2 Search vendor "Fedoraproject" for product "Sssd" and version "1.2.2" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.2.3 Search vendor "Fedoraproject" for product "Sssd" and version "1.2.3" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.2.4 Search vendor "Fedoraproject" for product "Sssd" and version "1.2.4" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.2.91 Search vendor "Fedoraproject" for product "Sssd" and version "1.2.91" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.3.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.3.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.3.1 Search vendor "Fedoraproject" for product "Sssd" and version "1.3.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.4.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.4.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.4.1 Search vendor "Fedoraproject" for product "Sssd" and version "1.4.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.1 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.2 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.2" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.3 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.3" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.4 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.4" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.5 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.5" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.6 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.6" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.6.1 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.6.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.7 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.7" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.8 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.8" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.9 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.9" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.10 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.10" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.11 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.11" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.12 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.12" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.13 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.13" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.14 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.14" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.15 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.15" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.16 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.16" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.5.17 Search vendor "Fedoraproject" for product "Sssd" and version "1.5.17" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.6.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.6.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.6.1 Search vendor "Fedoraproject" for product "Sssd" and version "1.6.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.6.2 Search vendor "Fedoraproject" for product "Sssd" and version "1.6.2" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.6.3 Search vendor "Fedoraproject" for product "Sssd" and version "1.6.3" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.6.4 Search vendor "Fedoraproject" for product "Sssd" and version "1.6.4" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.7.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.7.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.8.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.8.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.8.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.8.0" | beta1 |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.8.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.8.0" | beta2 |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.8.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.8.0" | beta3 |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.8.1 Search vendor "Fedoraproject" for product "Sssd" and version "1.8.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.8.2 Search vendor "Fedoraproject" for product "Sssd" and version "1.8.2" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.8.3 Search vendor "Fedoraproject" for product "Sssd" and version "1.8.3" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.8.4 Search vendor "Fedoraproject" for product "Sssd" and version "1.8.4" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.8.5 Search vendor "Fedoraproject" for product "Sssd" and version "1.8.5" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.8.6 Search vendor "Fedoraproject" for product "Sssd" and version "1.8.6" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.9.0 Search vendor "Fedoraproject" for product "Sssd" and version "1.9.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.9.1 Search vendor "Fedoraproject" for product "Sssd" and version "1.9.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Sssd Search vendor "Fedoraproject" for product "Sssd" | 1.9.2 Search vendor "Fedoraproject" for product "Sssd" and version "1.9.2" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 5 Search vendor "Redhat" for product "Enterprise Linux" and version "5" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 6.0 Search vendor "Redhat" for product "Enterprise Linux" and version "6.0" | - |
Affected
| ||||||