Scientific Linux 7: SLSA-2017-3379-1 Moderate: sssd Local Cache Exposure

It was found that sssd's sysdb_search_user_by_upn_res() function did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it. (CVE-2017-12173) Bug Fix(es): * Previously, SSSD's krb5 provider did not respect chang [More...]

Synopsis:          Moderate: sssd security and bug fix update
Advisory ID:       SLSA-2017:3379-1
Issue Date:        2017-12-05
CVE Numbers:       CVE-2017-12173
--

Security Fix(es):

* It was found that sssd's sysdb_search_user_by_upn_res() function did not
sanitize requests when querying its local cache and was vulnerable to
injection. In a centralized login environment, if a password hash was
locally cached for a given user, an authenticated attacker could use this
flaw to retrieve it. (CVE-2017-12173)

Bug Fix(es):

* Previously, SSSD's krb5 provider did not respect changed UIDs in ID
views overriding the default view. Consequently, Kerberos credential
caches were created with the incorrect, original UID, and processes of the
user were not able to find the changed UID. With this update, SSSD's krb5
provider is made aware of the proper ID view name and respects the ID
override data. As a result, the Kerberos credential cache is now created
with the expected UID, and the processes can find it.

* Previously, the list of cache request domains was sometimes freed in the
middle of a cache request operation due to the refresh domains request, as
they both were using the same list. As a consequence, a segmentation fault
sometimes occurred in SSSD. With this update, SSSD uses a copy of the
cache request domains' list for each cache request. As a result, SSSD no
longer crashes in this case.

* Previously, the calls provided by SSSD to send data to the Privilege
Attribute Certificate (PAC) responder did not use a mutex or any other
means to serialize access to the PAC responder from a single process. When
multithreaded applications overran the PAC responder with multiple
parallel requests, some threads did not receive a proper reply.
Consequently, such threads only resumed work after waiting 5 minutes for a
response. This update configures mutex to serialize access to the PAC
responder socket for multithreaded applications. As a result, all threads
now get a proper and timely reply.
--

SL7
  x86_64
    libipa_hbac-1.15.2-50.el7_4.8.i686.rpm
    libipa_hbac-1.15.2-50.el7_4.8.x86_64.rpm
    libsss_autofs-1.15.2-50.el7_4.8.x86_64.rpm
    libsss_certmap-1.15.2-50.el7_4.8.i686.rpm
    libsss_certmap-1.15.2-50.el7_4.8.x86_64.rpm
    libsss_idmap-1.15.2-50.el7_4.8.i686.rpm
    libsss_idmap-1.15.2-50.el7_4.8.x86_64.rpm
    libsss_nss_idmap-1.15.2-50.el7_4.8.i686.rpm
    libsss_nss_idmap-1.15.2-50.el7_4.8.x86_64.rpm
    libsss_simpleifp-1.15.2-50.el7_4.8.i686.rpm
    libsss_simpleifp-1.15.2-50.el7_4.8.x86_64.rpm
    libsss_sudo-1.15.2-50.el7_4.8.x86_64.rpm
    python-libipa_hbac-1.15.2-50.el7_4.8.x86_64.rpm
    python-sss-1.15.2-50.el7_4.8.x86_64.rpm
    python-sss-murmur-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-ad-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-client-1.15.2-50.el7_4.8.i686.rpm
    sssd-client-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-common-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-common-pac-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-dbus-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-debuginfo-1.15.2-50.el7_4.8.i686.rpm
    sssd-debuginfo-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-ipa-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-kcm-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-krb5-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-krb5-common-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-ldap-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-libwbclient-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-polkit-rules-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-proxy-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-tools-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-winbind-idmap-1.15.2-50.el7_4.8.x86_64.rpm
    libipa_hbac-devel-1.15.2-50.el7_4.8.i686.rpm
    libipa_hbac-devel-1.15.2-50.el7_4.8.x86_64.rpm
    libsss_certmap-devel-1.15.2-50.el7_4.8.i686.rpm
    libsss_certmap-devel-1.15.2-50.el7_4.8.x86_64.rpm
    libsss_idmap-devel-1.15.2-50.el7_4.8.i686.rpm
    libsss_idmap-devel-1.15.2-50.el7_4.8.x86_64.rpm
    libsss_nss_idmap-devel-1.15.2-50.el7_4.8.i686.rpm
    libsss_nss_idmap-devel-1.15.2-50.el7_4.8.x86_64.rpm
    libsss_simpleifp-devel-1.15.2-50.el7_4.8.i686.rpm
    libsss_simpleifp-devel-1.15.2-50.el7_4.8.x86_64.rpm
    python-libsss_nss_idmap-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-libwbclient-devel-1.15.2-50.el7_4.8.i686.rpm
    sssd-libwbclient-devel-1.15.2-50.el7_4.8.x86_64.rpm
    sssd-1.15.2-50.el7_4.8.src.rpm
  noarch
    python-sssdconfig-1.15.2-50.el7_4.8.noarch.rpm

- Scientific Linux Development Team