The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions.

When SSSD is configured as an Active Directory client by using the new Active Directory provider or equivalent configuration of the LDAP provider, the Simple Access Provider does not handle access control correctly. If any groups are specified with the simple_deny_groups option, the group members are permitted access. (CVE-2013-0287)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0663 advisory.

    [1.9.2-82.4]
    - Resolves: rhbz#911298 - sssd: simple access provider flaw prevents intended                                ACL use when client to an AD provider

    [1.9.2-82.3]
    - Fix pwd_expiration_warning=0
    - Resolves: rhbz#914671 - pwd_expiration_warning has wrong default for                               Kerberos

    [1.9.2-82.2]
    - Resolves: rhbz#914671 - pwd_expiration_warning has wrong default for                               Kerberos
    - Fix the NVR

    [1.9.2-82.1]
    - Resolves: rhbz#907362 - Serious performance regression in sssd

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Bug 923838 - CVE-2013-0287 sssd: simple access provider flaw prevents intended ACL use when client to an AD provider.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated sssd packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

SSSD (System Security Services Daemon) provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides NSS (Name Service Switch) and PAM (Pluggable Authentication Modules) interfaces toward the system and a pluggable back end system to connect to multiple different account sources.

When SSSD was configured as a Microsoft Active Directory client by using the new Active Directory provider (introduced in RHSA-2013:0508), the Simple Access Provider ('access_provider = simple' in '/etc/sssd/sssd.conf') did not handle access control correctly. If any groups were specified with the 'simple_deny_groups' option (in sssd.conf), all users were permitted access.
(CVE-2013-0287)

The CVE-2013-0287 issue was discovered by Kaushik Banerjee of Red Hat.

This update also fixes the following bugs :

* If a group contained a member whose Distinguished Name (DN) pointed out of any of the configured search bases, the search request that was processing this particular group never ran to completion. To the user, this bug manifested as a long timeout between requesting the group data and receiving the result. A patch has been provided to address this bug and SSSD now processes group search requests without delays.
(BZ#907362)

* The pwd_expiration_warning should have been set for seven days, but instead it was set to zero for Kerberos. This incorrect zero setting returned the 'always display warning if the server sends one' error message and users experienced problems in environments like IPA or Active Directory. Currently, the value setting for Kerberos is modified and this issue no longer occurs. (BZ#914671)

All users of sssd are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

When SSSD was configured as a Microsoft Active Directory client by using the new Active Directory provider (introduced in SLSA-2013:0508), the Simple Access Provider ('access_provider = simple' in '/etc/sssd/sssd.conf') did not handle access control correctly. If any groups were specified with the 'simple_deny_groups' option (in sssd.conf), all users were permitted access.
(CVE-2013-0287)

This update also fixes the following bugs :

  - If a group contained a member whose Distinguished Name     (DN) pointed out of any of the configured search bases,     the search request that was processing this particular     group never ran to completion. To the user, this bug     manifested as a long timeout between requesting the     group data and receiving the result. A patch has been     provided to address this bug and SSSD now processes     group search requests without delays.

  - The pwd_expiration_warning should have been set for     seven days, but instead it was set to zero for Kerberos.
    This incorrect zero setting returned the 'always display     warning if the server sends one' error message and users     experienced problems in environments like IPA or Active     Directory. Currently, the value setting for Kerberos is     modified and this issue no longer occurs.

ID	Name	Product	Family	Severity
74947	openSUSE Security Update : sssd (openSUSE-SU-2013:0559-1)	Nessus	SuSE Local Security Checks	medium
68793	Oracle Linux 6 : sssd (ELSA-2013-0663)	Nessus	Oracle Linux Local Security Checks	high
65750	Fedora 18 : sssd-1.9.4-7.fc18 (2013-4193)	Nessus	Fedora Local Security Checks	medium
65634	CentOS 6 : sssd (CESA-2013:0663)	Nessus	CentOS Local Security Checks	medium
65627	Scientific Linux Security Update : sssd on SL6.x i386/x86_64 (20130319)	Nessus	Scientific Linux Local Security Checks	medium
65626	RHEL 6 : sssd (RHSA-2013:0663)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2013-0287

medium

Tenable Plugins

medium

high

medium

medium

medium

medium