Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 522
Alerts This Week
Warning Icon 1 522

Red Hat: RHSA-2011:0560-01 Low Severity: SSSD Update and Fixes

red hat
Calendar Grey May 19, 2011
Dist Redhat Esm H88
Investigate the most recent Red Hat security bulletin regarding updates in sssd, addressing minor vulnerabilities, alongside improvements for RHEL 6.
Updated sssd packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259

Summary

The System Security Services Daemon (SSSD) provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back-end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects such as FreeIPA.
A flaw was found in the SSSD PAM responder that could allow a local attacker to crash SSSD via a carefully-crafted packet. With SSSD unresponsive, legitimate users could be denied the ability to log in to the system. (CVE-2010-4341)
Red Hat would like to thank Sebastian Krahmer for reporting this issue.
This update also fixes several bugs and adds various enhancements. Documentation for these bug fixes and enhancements will be available shortly from the Technical Notes document, linked to in the References section.
Users of SSSD should upgrade to these updated packages, which upgrade SSSD to upstream version 1.5.1 to correct this issue, and fix the bugs and add the enhancements noted in the Technical Notes.

Topics%20covered

Topics Covered

security advisory low severity access management red hat enterprise sssd update

References

https://access.redhat.com/security/cve/CVE-2010-4341 https://access.redhat.com/security/updates/classification#low https://access.redhat.com/search/

Package List

Red Hat Enterprise Linux Desktop (v. 6):
Source:
i386: sssd-1.5.1-34.el6.i686.rpm sssd-client-1.5.1-34.el6.i686.rpm sssd-debuginfo-1.5.1-34.el6.i686.rpm
x86_64: sssd-1.5.1-34.el6.x86_64.rpm sssd-client-1.5.1-34.el6.i686.rpm sssd-client-1.5.1-34.el6.x86_64.rpm sssd-debuginfo-1.5.1-34.el6.i686.rpm sssd-debuginfo-1.5.1-34.el6.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
Source:
i386: sssd-debuginfo-1.5.1-34.el6.i686.rpm sssd-tools-1.5.1-34.el6.i686.rpm
x86_64: sssd-debuginfo-1.5.1-34.el6.x86_64.rpm sssd-tools-1.5.1-34.el6.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
i386: sssd-1.5.1-34.el6.i686.rpm sssd-client-1.5.1-34.el6.i686.rpm sssd-debuginfo-1.5.1-34.el6.i686.rpm
ppc64: sssd-1.5.1-34.el6.ppc64.rpm sssd-client-1.5.1-34.el6.ppc.rpm sssd-client-1.5.1-34.el6.ppc64.rpm sssd-debuginfo-1.5.1-34.el6.ppc.rpm sssd-debuginfo-1.5.1-34.el6.ppc64.rpm
s390x: sssd-1.5.1-34.el6.s390x.rpm sssd-client-1.5.1-34.el6.s390.rpm sssd-client-1.5.1-34.el6.s390x.rpm sssd-debuginfo-1.5.1-34.el6.s390.rpm sssd-debuginfo-1.5.1-34.el6.s390x.rpm
x86_64: sssd-1.5.1-34.el6.x86_64.rpm sssd-client-1.5.1-34.el6.i686.rpm sssd-client-1.5.1-34.el6.x86_64.rpm sssd-debuginfo-1.5.1-34.el6.i686.rpm sssd-debuginfo-1.5.1-34.el6.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):


Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2011:0560-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2011:0560.html
Issue date: 2011-05-19

Topic

Updated sssd packages that fix one security issue, several bugs, and addvarious enhancements are now available for Red Hat Enterprise Linux 6.The Red Hat Security Response Team has rated this update as having lowsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available from the CVE link inthe References section.

Topics%20covered

Topics Covered

security advisory low severity access management red hat enterprise sssd update

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

Bugs Fixed

442680 - Better support for Kerberos ticket cache management

598501 - SSSD doesn't follow LDAP referrals when using non-anonymous bind

633406 - the krb5 locator plugin isn't packaged for multilib

633487 - SSSD initgroups does not behave as expected

640602 - sssd is not escaping correctly LDAP searches

644072 - Rebase SSSD to 1.5

645438 - NSS responder dies if DP dies during a request

645449 - 'getent passwd ' returns nothing if its uidNumber gt 2147483647.

647816 - Login screen freezes for more than 2mins when configured SSSD for proxy auth.

649286 - SSSD will sometimes lose groups from the cache

658158 - sssd stops on upgrade

659401 - SSSD shutdown sometimes hangs

660323 - Provide an option to specify DNS domain for service discovery

661163 - CVE-2010-4341 sssd: DoS in sssd PAM responder can prevent logins

667059 - nss client blocks when enumerating local domain after restart.

667326 - '-s' option in sss_obfuscate command is a bit redundant.

667349 - Obfuscated passwords can kill LDAP provider if OpenLDAP uses NSS.

670511 - SSSD and sftp-only jailed users with pubkey login

670763 - Missing primary group with simple access provider.

670804 - Nested groups are not unrolled during the first enumeration.

671478 - authconfig-tui/gtk removes "ldap_user_home_directory" from sssd.conf

674141 - Traceback call messages displayed while "sss_obfuscate" command is executed as a non-root user.

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.