The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sssd: information leak from the sssd-sudo responder (CVE-2018-10852)

  - The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-     POSIX group is in a group membership chain, which allows local users to bypass access restrictions via     unspecified vectors. (CVE-2014-0249)

  - Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System     Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of     service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during     Kerberos authentication. (CVE-2015-5292)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for sssd fixes one security issue and three bugs.

The following vulnerability was fixed :

  - CVE-2014-0249: Incorrect expansion of group membership     when encountering a non-POSIX group. (bsc#880245)

The following non-security fixes were also included :

  - Prevent crashes of statically linked binaries using     getpwuid when sssd is used and nscd is turned off or has     caching disabled. (bsc#993582)

  - Add logrotate configuration to prevent log files from     growing too large when running with debug mode enabled.
    (bsc#1004220)

  - Order sudo rules by the same logic used by the native     LDAP support from sudo. (bsc#1002973)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for sssd fixes one security issue and three bugs. The following vulnerability was fixed :

  - CVE-2014-0249: Incorrect expansion of group membership     when encountering a non-POSIX group. (bsc#880245) The     following non-security fixes were also included :

  - Prevent crashes of statically linked binaries using     getpwuid when sssd is used and nscd is turned off or has     caching disabled. (bsc#993582)

  - Add logrotate configuration to prevent log files from     growing too large when running with debug mode enabled.
    (bsc#1004220)

  - Order sudo rules by the same logic used by the native     LDAP support from sudo. (bsc#1002973)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

sssd was updated to new upstream release 1.12.2 (bugfix release, bnc#900159)

Changes :

  - Fixed a regression where the IPA provider did not fetch     User Private Groups correctly

  - An important bug in the GPO access control which     resulted in a wrong principal being used, was fixed.

  - Several new options are available for deployments that     need to restrict a certain PAM service from connecting     to a certain SSSD domain. For more details, see the     description of pam_trusted_users and pam_public_domains     options in the sssd.conf(5) man page and the domains     option in the pam_sss(8) man page.

  - When SSSD is acting as an IPA client in setup with     trusted AD domains, it is able to return group members     or full group memberships for users from trusted AD     domains.

  - Support for the 'views' feature of IPA.

  - The GPO access control was further enhanced to allow the     access control decisions while offline and map the     Windows logon rights onto Linux PAM services.

  - The SSSD now ships a plugin for the rpc.idmapd daemon,     sss_rpcidmapd(5).

  - A MIT Kerberos localauth plugin was added to SSSD. This     plugin helps translating principals to user names in     IPA-AD trust scenarios, allowing the krb5.conf     configuration to be less complex.

  - A libwbclient plugin implementation is now part of the     SSSD. The main purpose is to map Active Directory users     and groups identified by their SID to POSIX users and     groups for the file-server use-case.

  - Active Directory users ca nnow use their User Logon Name     to log in.

  - The sss_cache tool was enhanced to allow invalidating     the SSH host keys.

  - Groups without full POSIX information can now be used to     enroll group membership (CVE-2014-0249).

  - Detection of transition from offline to online state was     improved, resulting in fewer timeouts when SSSD is     offline.

  - The Active Directory provider now correctly detects     Windows Server 2012 R2. Previous versions would fall     back to the slower non-AD path with 2012 R2.

  - Several other bugs related to deployments where SSSD is     acting as an AD client were fixed.

ID	Name	Product	Family	Severity
198935	RHEL 5 : sssd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
94312	openSUSE Security Update : sssd (openSUSE-2016-1238)	Nessus	SuSE Local Security Checks	low
94275	SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2016:2579-1)	Nessus	SuSE Local Security Checks	low
79225	openSUSE Security Update : sssd (openSUSE-SU-2014:1407-1)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2014-0249

medium

Tenable Plugins

high

low

low

low