It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.

The remote NewStart CGSL host, running version MAIN 4.05, has sssd packages installed that are affected by a vulnerability:

  - It was found that sssd's sysdb_search_user_by_upn_res()     function did not sanitize requests when querying its     local cache and was vulnerable to injection. In a     centralized login environment, if a password hash was     locally cached for a given user, an authenticated     attacker could use this flaw to retrieve it.
    (CVE-2017-12173)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 5.04, has sssd packages installed that are affected by a vulnerability:

  - It was found that sssd's sysdb_search_user_by_upn_res()     function did not sanitize requests when querying its     local cache and was vulnerable to injection. In a     centralized login environment, if a password hash was     locally cached for a given user, an authenticated     attacker could use this flaw to retrieve it.
    (CVE-2017-12173)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the sssd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The UNIX pipe which sudo uses to contact SSSD and read     the available sudo rules from SSSD utilizes too broad     of a set of permissions. Any user who can send a     message using the same raw protocol that sudo and SSSD     use can read the sudo rules available for any     user.(CVE-2018-10852)

  - It was found that sssd's sysdb_search_user_by_upn_res()     function did not sanitize requests when querying its     local cache and was vulnerable to injection. In a     centralized login environment, if a password hash was     locally cached for a given user, an authenticated     attacker could use this flaw to retrieve     it.(CVE-2017-12173)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - It was found that sssd's sysdb_search_user_by_upn_res()     function did not sanitize requests when querying its     local cache and was vulnerable to injection. In a     centralized login environment, if a password hash was     locally cached for a given user, an authenticated     attacker could use this flaw to retrieve     it.(CVE-2017-12173)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ding-libs packages contain a set of libraries used by the System Security Services Daemon (SSSD) as well as other projects, and provide functions to manipulate file system path names (libpath_utils), a hash table to manage storage and access time properties (libdhash), a data type to collect data in a hierarchical structure (libcollection), a dynamically growing, reference-counted array (libref_array), and a library to process configuration files in initialization format (INI) into a library collection data structure (libini_config).

Security Fix(es) :

  - sssd: unsanitized input when searching in local cache     database (CVE-2017-12173)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-1877 advisory.

    - Resolves: rhbz#1507435 - CVE-2017-12173 sssd: unsanitized input when searching in local cache database     [rhel-6.10]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for sssd and ding-libs is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

The ding-libs packages contain a set of libraries used by the System Security Services Daemon (SSSD) as well as other projects, and provide functions to manipulate file system path names (libpath_utils), a hash table to manage storage and access time properties (libdhash), a data type to collect data in a hierarchical structure (libcollection), a dynamically growing, reference-counted array (libref_array), and a library to process configuration files in initialization format (INI) into a library collection data structure (libini_config).

Security Fix(es) :

* sssd: unsanitized input when searching in local cache database (CVE-2017-12173)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Sumit Bose (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.10 Release Notes and Red Hat Enterprise Linux 6.10 Technical Notes linked from the References section.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1877 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    The ding-libs packages contain a set of libraries used by the System Security Services Daemon (SSSD) as     well as other projects, and provide functions to manipulate file system path names (libpath_utils), a hash     table to manage storage and access time properties (libdhash), a data type to collect data in a     hierarchical structure (libcollection), a dynamically growing, reference-counted array (libref_array), and     a library to process configuration files in initialization format (INI) into a library collection data     structure (libini_config).

    Security Fix(es):

    * sssd: unsanitized input when searching in local cache database (CVE-2017-12173)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    This issue was discovered by Sumit Bose (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.10 Release Notes     and Red Hat Enterprise Linux 6.10 Technical Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for [CVE-2017-12173]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3526-1 advisory.

    It was discovered that SSSD incorrectly handled certain inputs when querying its local cache. An attacker     could use this to inject arbitrary code and expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Unsanitized input when searching in local cache database

It was found that sssd's sysdb_search_user_by_upn_res() function did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it. (CVE-2017-12173)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that sssd's sysdb_search_user_by_upn_res()     function did not sanitize requests when querying its     local cache and was vulnerable to injection. In a     centralized login environment, if a password hash was     locally cached for a given user, an authenticated     attacker could use this flaw to retrieve     it.(CVE-2017-12173)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for sssd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

Security Fix(es) :

* It was found that sssd's sysdb_search_user_by_upn_res() function did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it. (CVE-2017-12173)

This issue was discovered by Sumit Bose (Red Hat).

Bug Fix(es) :

* Previously, SSSD's krb5 provider did not respect changed UIDs in ID views overriding the default view. Consequently, Kerberos credential caches were created with the incorrect, original UID, and processes of the user were not able to find the changed UID. With this update, SSSD's krb5 provider is made aware of the proper ID view name and respects the ID override data. As a result, the Kerberos credential cache is now created with the expected UID, and the processes can find it. (BZ#1508972)

* Previously, the list of cache request domains was sometimes freed in the middle of a cache request operation due to the refresh domains request, as they both were using the same list. As a consequence, a segmentation fault sometimes occurred in SSSD. With this update, SSSD uses a copy of the cache request domains' list for each cache request.
As a result, SSSD no longer crashes in this case. (BZ#1509177)

* Previously, the calls provided by SSSD to send data to the Privilege Attribute Certificate (PAC) responder did not use a mutex or any other means to serialize access to the PAC responder from a single process.
When multithreaded applications overran the PAC responder with multiple parallel requests, some threads did not receive a proper reply. Consequently, such threads only resumed work after waiting 5 minutes for a response. This update configures mutex to serialize access to the PAC responder socket for multithreaded applications. As a result, all threads now get a proper and timely reply. (BZ#1506682)

Security Fix(es) :

  - It was found that sssd's sysdb_search_user_by_upn_res()     function did not sanitize requests when querying its     local cache and was vulnerable to injection. In a     centralized login environment, if a password hash was     locally cached for a given user, an authenticated     attacker could use this flaw to retrieve it.
    (CVE-2017-12173)

Bug Fix(es) :

  - Previously, SSSD's krb5 provider did not respect changed     UIDs in ID views overriding the default view.
    Consequently, Kerberos credential caches were created     with the incorrect, original UID, and processes of the     user were not able to find the changed UID. With this     update, SSSD's krb5 provider is made aware of the proper     ID view name and respects the ID override data. As a     result, the Kerberos credential cache is now created     with the expected UID, and the processes can find it.

  - Previously, the list of cache request domains was     sometimes freed in the middle of a cache request     operation due to the refresh domains request, as they     both were using the same list. As a consequence, a     segmentation fault sometimes occurred in SSSD. With this     update, SSSD uses a copy of the cache request domains'     list for each cache request. As a result, SSSD no longer     crashes in this case.

  - Previously, the calls provided by SSSD to send data to     the Privilege Attribute Certificate (PAC) responder did     not use a mutex or any other means to serialize access     to the PAC responder from a single process. When     multithreaded applications overran the PAC responder     with multiple parallel requests, some threads did not     receive a proper reply. Consequently, such threads only     resumed work after waiting 5 minutes for a response.
    This update configures mutex to serialize access to the     PAC responder socket for multithreaded applications. As     a result, all threads now get a proper and timely reply.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:3379 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    Security Fix(es):

    * It was found that sssd's sysdb_search_user_by_upn_res() function did not sanitize requests when querying     its local cache and was vulnerable to injection. In a centralized login environment, if a password hash     was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.
    (CVE-2017-12173)

    This issue was discovered by Sumit Bose (Red Hat).

    Bug Fix(es):

    * Previously, SSSD's krb5 provider did not respect changed UIDs in ID views overriding the default view.
    Consequently, Kerberos credential caches were created with the incorrect, original UID, and processes of     the user were not able to find the changed UID. With this update, SSSD's krb5 provider is made aware of     the proper ID view name and respects the ID override data. As a result, the Kerberos credential cache is     now created with the expected UID, and the processes can find it. (BZ#1508972)

    * Previously, the list of cache request domains was sometimes freed in the middle of a cache request     operation due to the refresh domains request, as they both were using the same list. As a consequence, a     segmentation fault sometimes occurred in SSSD. With this update, SSSD uses a copy of the cache request     domains' list for each cache request. As a result, SSSD no longer crashes in this case. (BZ#1509177)

    * Previously, the calls provided by SSSD to send data to the Privilege Attribute Certificate (PAC)     responder did not use a mutex or any other means to serialize access to the PAC responder from a single     process. When multithreaded applications overran the PAC responder with multiple parallel requests, some     threads did not receive a proper reply. Consequently, such threads only resumed work after waiting 5     minutes for a response. This update configures mutex to serialize access to the PAC responder socket for     multithreaded applications. As a result, all threads now get a proper and timely reply. (BZ#1506682)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3379 advisory.

    [1.15.2-50.8]
    - Resolves: rhbz#1508972 - Accessing IdM kerberos ticket fails while id                                mapping is applied [rhel-7.4.z]
    - Resolves: rhbz#1509177 - Race condition between refreshing the cr_domain                                list and a request that is using the list can                                cause a segfault is sssd_nss [rhel-7.4.z]

    [1.15.2-50.7]
    - Resolves: rhbz#1506142 - SSSD can crash due to ABI changes in                                libldb >= 1.2.0 (1.1.30) [rhel-7.4.z]
    - Resolves: rhbz#1506682 - sssd_client: add mutex protected call to the                                PAC responder [rhel-7.4.z]
    - Resolves: rhbz#1499658 - CVE-2017-12173 sssd: unsanitized input when                                searching in local cache database [rhel-7.4.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for sssd provides the following fixes: Security issues fixed :

  - CVE-2017-12173: Fixed unsanitized input when searching     in local cache database (bsc#1061832). Non security     issues fixed :

  - Fixed a segfault issue in     ldap_rfc_2307_fallback_to_local_users. (bsc#1055123)

  - Install /var/lib/sss/mc directory to correct sssd cache     invalidation behaviour. (bsc#1039567)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sssd provides the following fixes :

Security issues fixed :

  - CVE-2017-12173: Fixed unsanitized input when searching     in local cache database (bsc#1061832).

Non security issues fixed :

  - Fixed a segfault issue in     ldap_rfc_2307_fallback_to_local_users. (bsc#1055123)

  - Install /var/lib/sss/mc directory to correct sssd cache     invalidation behaviour. (bsc#1039567)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

ID	Name	Product	Family	Severity
127388	NewStart CGSL MAIN 4.05 : sssd Vulnerability (NS-SA-2019-0132)	Nessus	NewStart CGSL Local Security Checks	high
127143	NewStart CGSL MAIN 5.04 : sssd Vulnerability (NS-SA-2019-0002)	Nessus	NewStart CGSL Local Security Checks	high
124914	EulerOS Virtualization for ARM 64 3.0.1.0 : sssd (EulerOS-SA-2019-1411)	Nessus	Huawei Local Security Checks	high
117582	EulerOS Virtualization 2.5.1 : sssd (EulerOS-SA-2018-1273)	Nessus	Huawei Local Security Checks	high
110892	Scientific Linux Security Update : sssd and ding-libs on SL6.x i386/x86_64 (20180619)	Nessus	Scientific Linux Local Security Checks	high
110703	Oracle Linux 6 : sssd / and / ding-libs (ELSA-2018-1877)	Nessus	Oracle Linux Local Security Checks	high
110647	CentOS 6 : ding-libs / sssd (CESA-2018:1877)	Nessus	CentOS Local Security Checks	high
110602	RHEL 6 : sssd and ding-libs (RHSA-2018:1877)	Nessus	Red Hat Local Security Checks	high
105859	Fedora 27 : sssd (2017-39c5f8cd7e)	Nessus	Fedora Local Security Checks	high
105749	Ubuntu 16.04 LTS : SSSD vulnerability (USN-3526-1)	Nessus	Ubuntu Local Security Checks	high
105420	Amazon Linux AMI : sssd (ALAS-2017-935)	Nessus	Amazon Linux Local Security Checks	high
105306	EulerOS 2.0 SP2 : sssd (EulerOS-SA-2017-1325)	Nessus	Huawei Local Security Checks	high
105305	EulerOS 2.0 SP1 : sssd (EulerOS-SA-2017-1324)	Nessus	Huawei Local Security Checks	high
105059	CentOS 7 : sssd (CESA-2017:3379)	Nessus	CentOS Local Security Checks	high
105032	Scientific Linux Security Update : sssd on SL7.x x86_64 (20171205)	Nessus	Scientific Linux Local Security Checks	high
105017	RHEL 7 : sssd (RHSA-2017:3379)	Nessus	Red Hat Local Security Checks	high
105016	Oracle Linux 7 : sssd (ELSA-2017-3379)	Nessus	Oracle Linux Local Security Checks	high
104430	SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2017:2937-1)	Nessus	SuSE Local Security Checks	high
104426	openSUSE Security Update : sssd (openSUSE-2017-1251)	Nessus	SuSE Local Security Checks	high
104225	Fedora 25 : sssd (2017-88a1f4854d)	Nessus	Fedora Local Security Checks	high
104060	Fedora 26 : sssd (2017-65b543b628)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-12173

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high