Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 547
Alerts This Week
Warning Icon 1 547

Red Hat 5: RHSA-2011:0975-01 Low Severity: SSSD Denial of Service Issue Fix

red hat
Calendar Grey July 21, 2011
Scroller Redhat Esm H88
Recent sssd updates mitigate minor security vulnerabilities and fix bugs for Red Hat Enterprise Linux.
Updated sssd packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259

Summary

The System Security Services Daemon (SSSD) provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back-end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects such as FreeIPA.
A flaw was found in the SSSD PAM responder that could allow a local attacker to force SSSD to enter an infinite loop via a carefully-crafted packet. With SSSD unresponsive, legitimate users could be denied the ability to log in to the system. (CVE-2010-4341)
Red Hat would like to thank Sebastian Krahmer for reporting this issue.
These updated sssd packages include a number of bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Refer to the Red Hat Enterprise Linux 5.7 Technical Notes for information about these changes:
https://access.redhat.com/search/ nical_Notes/sssd.html#RHSA-2011-0975
All sssd users are advised to upgrade to these updated sssd packages, which upgrade SSSD to upstream version 1.5.1 to correct this issue, and fix the bugs and add the enhancements noted in the Technical Notes.

Topics%20covered

Topics Covered

security advisory Red Hat DoS issue bug fix sssd update

References

https://access.redhat.com/security/cve/CVE-2010-4341 https://access.redhat.com/security/updates/classification#low https://fedoraproject.org/wiki/Infrastructure/Fedorahosted-retirement https://access.redhat.com/search/

Package List

Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
i386: sssd-1.5.1-37.el5.i386.rpm sssd-client-1.5.1-37.el5.i386.rpm sssd-debuginfo-1.5.1-37.el5.i386.rpm sssd-tools-1.5.1-37.el5.i386.rpm
x86_64: sssd-1.5.1-37.el5.x86_64.rpm sssd-client-1.5.1-37.el5.i386.rpm sssd-client-1.5.1-37.el5.x86_64.rpm sssd-debuginfo-1.5.1-37.el5.i386.rpm sssd-debuginfo-1.5.1-37.el5.x86_64.rpm sssd-tools-1.5.1-37.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
i386: sssd-1.5.1-37.el5.i386.rpm sssd-client-1.5.1-37.el5.i386.rpm sssd-debuginfo-1.5.1-37.el5.i386.rpm sssd-tools-1.5.1-37.el5.i386.rpm
ia64: sssd-1.5.1-37.el5.ia64.rpm sssd-client-1.5.1-37.el5.i386.rpm sssd-client-1.5.1-37.el5.ia64.rpm sssd-debuginfo-1.5.1-37.el5.i386.rpm sssd-debuginfo-1.5.1-37.el5.ia64.rpm sssd-tools-1.5.1-37.el5.ia64.rpm
ppc: sssd-1.5.1-37.el5.ppc.rpm sssd-client-1.5.1-37.el5.ppc.rpm sssd-client-1.5.1-37.el5.ppc64.rpm sssd-debuginfo-1.5.1-37.el5.ppc.rpm sssd-debuginfo-1.5.1-37.el5.ppc64.rpm sssd-tools-1.5.1-37.el5.ppc.rpm
s390x: sssd-1.5.1-37.el5.s390x.rpm sssd-client-1.5.1-37.el5.s390.rpm sssd-client-1.5.1-37.el5.s390x.rpm sssd-debuginfo-1.5.1-37.el5.s390.rpm sssd-debuginfo-1.5.1-37.el5.s390x.rpm sssd-tools-1.5.1-37.el5.s390x.rpm
x86_64: sssd-1.5.1-37.el5.x86_64.rpm

Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2011:0975-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2011:0975.html
Issue date: 2011-07-21

Topic

Updated sssd packages that fix one security issue, several bugs, and addvarious enhancements are now available for Red Hat Enterprise Linux 5.The Red Hat Security Response Team has rated this update as having lowsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available from the CVE link inthe References section.

Topics%20covered

Topics Covered

security advisory Red Hat DoS issue bug fix sssd update

Relevant Releases Architectures

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

Bugs Fixed

640601 - sssd is not escaping correctly LDAP searches

661163 - CVE-2010-4341 sssd: DoS in sssd PAM responder can prevent logins

675007 - sssd corrupts group cache

676027 - sssd segfault when first entry of ldap_uri is unreachable

678032 - Remove HBAC time rules from SSSD

678092 - SSSD in 5.6 can not locate HBAC rules from FreeIPAv2

678412 - name service caches names, so id command shows recently deleted users678606 - User information not updated on login for secondary domains

678615 - SSSD needs to look at IPA's compat tree for netgroups

678778 - IPA provider does not update removed group memberships on initgroups

678780 - sssd crashes at the next tgt renewals it tries.

679087 - SSSD IPA provider should honor the krb5_realm option

679097 - Does not read renewable ccache at startup.

682803 - sssd-be segmentation fault - ipa-client on ipa-server

682808 - sssd_nss core dumps with certain lookups

682853 - IPA provider should use realm instead of ipa_domain for base DN

683260 - sudo/ldap lookup via sssd gets stuck for 5min waiting on netgroup

688677 - Build SSSD in RHEL 5.7 against openldap24-libs

688694 - authconfig fails when access_provider is set as krb5 in sssd.conf.

688697 - sssd 1.5.1-9 breaks AD authentication

689887 - group memberships are not populated correctly during IPA provider initgroups

690093 - multiple problems with sssd + ldap (Active-Directory) and groups members.

690096 - SSSD should skip over groups with multiple names

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.