Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Red Hat Enterprise Linux 7: RHSA-2015-2355-01 Low: sssd Memory Leak

red hat
Calendar Grey November 19, 2015
Scroller Redhat
Newly released sssd updates are now accessible for Red Hat Enterprise Linux 7, addressing minor security vulnerabilities and bugs.
Updated sssd packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms.
It was found that SSSD's Privilege Attribute Certificate (PAC) responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in. (CVE-2015-5292)
The sssd packages have been upgraded to upstream version 1.13.0, which provides a number of bug fixes and enhancements over the previous version. (BZ#1205554)
Several enhancements are described in the Red Hat Enterprise Linux 7.2 Release Notes, linked to in the References section:
* SSSD smart card support (BZ#854396) * Cache authentication in SSSD (BZ#910187) * SSSD supports overriding automatically discovered AD site (BZ#1163806) * SSSD can now deny SSH access to locked accounts (BZ#1175760) * SSSD enables UID and GID mapping on individual clients (BZ#1183747) * Background refresh of cached entries (BZ#1199533) * Multi-step prompting for one-time and long-term passwords (BZ#1200873) * Caching for initgroups operations (BZ#1206575)

Topics%20covered

Topics Covered

security advisory Red Hat bug fix system enhancement authentication issue low impact sssd update

References

https://access.redhat.com/security/cve/CVE-2015-5292 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.2_Release_Notes/index.html

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: sssd-1.13.0-40.el7.src.rpm
noarch: python-sssdconfig-1.13.0-40.el7.noarch.rpm
x86_64: libipa_hbac-1.13.0-40.el7.i686.rpm libipa_hbac-1.13.0-40.el7.x86_64.rpm libsss_idmap-1.13.0-40.el7.i686.rpm libsss_idmap-1.13.0-40.el7.x86_64.rpm libsss_nss_idmap-1.13.0-40.el7.i686.rpm libsss_nss_idmap-1.13.0-40.el7.x86_64.rpm python-libipa_hbac-1.13.0-40.el7.x86_64.rpm python-sss-1.13.0-40.el7.x86_64.rpm python-sss-murmur-1.13.0-40.el7.x86_64.rpm sssd-1.13.0-40.el7.x86_64.rpm sssd-ad-1.13.0-40.el7.x86_64.rpm sssd-client-1.13.0-40.el7.i686.rpm sssd-client-1.13.0-40.el7.x86_64.rpm sssd-common-1.13.0-40.el7.i686.rpm sssd-common-1.13.0-40.el7.x86_64.rpm sssd-common-pac-1.13.0-40.el7.x86_64.rpm sssd-dbus-1.13.0-40.el7.x86_64.rpm sssd-debuginfo-1.13.0-40.el7.i686.rpm sssd-debuginfo-1.13.0-40.el7.x86_64.rpm sssd-ipa-1.13.0-40.el7.x86_64.rpm sssd-krb5-1.13.0-40.el7.x86_64.rpm sssd-krb5-common-1.13.0-40.el7.i686.rpm sssd-krb5-common-1.13.0-40.el7.x86_64.rpm sssd-ldap-1.13.0-40.el7.x86_64.rpm sssd-libwbclient-1.13.0-40.el7.x86_64.rpm sssd-proxy-1.13.0-40.el7.x86_64.rpm sssd-tools-1.13.0-40.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: libipa_hbac-devel-1.13.0-40.el7.i686.rpm libipa_hbac-devel-1.13.0-40.el7.x86_64.rpm

Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2015:2355-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2015:2355.html
Issue date: 2015-11-19

Topic

Updated sssd packages that fix one security issue, multiple bugs, and addvarious enhancements are now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having Low securityimpact. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available from the CVE link in theReferences section.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix system enhancement authentication issue low impact sssd update

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - aarch64, noarch, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Bugs Fixed

* When the SELinux user content on an IdM server was set to an empty

string, the SSSD SELinux evaluation utility returned an error. (BZ#1192314)

* If the ldap_child process failed to initialize credentials and exited

with an error multiple times, operations that create files in some cases

started failing due to an insufficient amount of i-nodes. (BZ#1198477)

* The SRV queries used a hard coded TTL timeout, and environments that

wanted the SRV queries to be valid for a certain time only were blocked.

Now, SSSD parses the TTL value out of the DNS packet. (BZ#1199541)

* Previously, initgroups operation took an excessive amount of time. Now,

logins and ID processing are faster for setups with AD back end and

disabled ID mapping. (BZ#1201840)

* When an IdM client with Red Hat Enterprise Linux 7.1 or later was

connecting to a server with Red Hat Enterprise Linux 7.0 or earlier,

authentication with an AD trusted domain caused the sssd_be process to

terminate unexpectedly. (BZ#1202170)

* If replication conflict entries appeared during HBAC processing, the user

was denied access. Now, the replication conflict entries are skipped and

users are permitted access. (BZ#1202245)

* The array of SIDs no longer contains an uninitialized value and SSSD no

longer crashes. (BZ#1204203)

* SSSD supports GPOs from different domain controllers and no longer

crashes when processing GPOs from different domain controllers.

(BZ#1205852)

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.