The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sssd: information leak from the sssd-sudo responder (CVE-2018-10852)

  - The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-     POSIX group is in a group membership chain, which allows local users to bypass access restrictions via     unspecified vectors. (CVE-2014-0249)

  - Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System     Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of     service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during     Kerberos authentication. (CVE-2015-5292)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sssd: information leak from the sssd-sudo responder (CVE-2018-10852)

  - sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to     the allowed_uids configuration parameter. If sensitive information were stored in the user directory,     this could be inadvertently disclosed to local attackers. (CVE-2018-16883)

  - A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services     that restrict the user's filesystem access to within their home directory through chroot() etc. All     versions before 2.1 are vulnerable. (CVE-2019-3811)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5067-1 advisory.

    Jakub Hrozek discovered that SSSD incorrectly handled file permissions. A local attacker could possibly     use this issue to read the sudo rules available for any user. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2018-10852)

    It was discovered that SSSD incorrectly handled Group Policy Objects. When SSSD is configured with too     strict permissions causing the GPO to not be readable, SSSD will allow all authenticated users to login     instead of being denied, contrary to expectations. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2018-16838)

    It was discovered that SSSD incorrectly handled users with no home directory set. When no home directory     was set, SSSD would return the root directory instead of an empty string, possibly bypassing security     measures. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3811)

    Cedric Buissart discovered that SSSD incorrectly handled the sssctl command. In certain environments, a     local user could use this issue to execute arbitrary commands and possibly escalate privileges.
    (CVE-2021-3621)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sssd packages installed that are affected by a vulnerability:

  - The UNIX pipe which sudo uses to contact SSSD and read     the available sudo rules from SSSD utilizes too broad of     a set of permissions. Any user who can send a message     using the same raw protocol that sudo and SSSD use can     read the sudo rules available for any user.
    (CVE-2018-10852)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the sssd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The UNIX pipe which sudo uses to contact SSSD and read     the available sudo rules from SSSD utilizes too broad     of a set of permissions. Any user who can send a     message using the same raw protocol that sudo and SSSD     use can read the sudo rules available for any     user.(CVE-2018-10852)

  - It was found that sssd's sysdb_search_user_by_upn_res()     function did not sanitize requests when querying its     local cache and was vulnerable to injection. In a     centralized login environment, if a password hash was     locally cached for a given user, an authenticated     attacker could use this flaw to retrieve     it.(CVE-2017-12173)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The UNIX pipe which sudo uses to contact SSSD and read     the available sudo rules from SSSD utilizes too broad     of a set of permissions. Any user who can send a     message using the same raw protocol that sudo and SSSD     use can read the sudo rules available for any     user.i1/4^CVE-2018-10852i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sssd fixes the following security issue :

  - CVE-2018-10852: Set stricter permissions on     /var/lib/sss/pipes/sudo to prevent the disclosure of     sudo rules for arbitrary users (bsc#1098377).

This update was imported from the SUSE:SLE-15:Update update project.

This update for sssd fixes the following issues :

Security vulnerabilities addressed :

Fix fallback_homedir returning '/' for empty home directories (CVE-2019-3811) (bsc#1121759)

Create sockets with right permissions (bsc#1098377, CVE-2018-10852)

Other bug fixes and changes: Install logrotate configuration (bsc#1004220)

Strip whitespaces in netgroup triples (bsc#1087320)

Align systemd service file with upstream

  - Run interactive and change service type to notify     (bsc#1120852)

  - Replace deprecated '-f' and use '--logger'

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.
(CVE-2018-10852)

This update for sssd provides the following fixes :

This security issue was fixed :

CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sssd provides the following fixes :

This security issue was fixed :

  - CVE-2018-10852: Set stricter permissions on     /var/lib/sss/pipes/sudo to prevent the disclosure of     sudo rules for arbitrary users (bsc#1098377)

These non-security issues were fixed :

  - Fix a segmentation fault in sss_cache command.
    (bsc#1072728)

  - Fix a failure in autofs initialisation sequence upon     system boot. (bsc#1010700)

  - Fix race condition on boot between SSSD and autofs.
    (bsc#1010700)

  - Fix a bug where file descriptors were not closed     (bsc#1080156)

  - Fix an issue where sssd logs were not rotated properly     (bsc#1080156)

  - Remove whitespaces from netgroup entries (bsc#1087320)

  - Remove misleading log messages (bsc#1101877)

  - exit() the forked process if exec()-ing a child process     fails (bsc#1110299)

  - Do not schedule the machine renewal task if adcli is not     executable (bsc#1110299)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for sssd fixes the following security issue :

  - CVE-2018-10852: Set stricter permissions on     /var/lib/sss/pipes/sudo to prevent the disclosure of     sudo rules for arbitrary users (bsc#1098377).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - sssd: information leak from the sssd-sudo     responder.(CVE-2018-10852)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.(CVE-2018-10852)

Security Fix(es) :

  - sssd: information leak from the sssd-sudo responder     (CVE-2018-10852)

An update for sssd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

The following packages have been upgraded to a later upstream version:
sssd (1.16.2). (BZ#1558498)

Security Fix(es) :

* sssd: information leak from the sssd-sudo responder (CVE-2018-10852)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Jakub Hrozek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-3158 advisory.

    - Resolves: rhbz#1590603 - EMBARGOED CVE-2018-10852 sssd: information leak from the sssd-sudo responder     [rhel-7]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3158 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    The following packages have been upgraded to a later upstream version: sssd (1.16.2). (BZ#1558498)

    Security Fix(es):

    * sssd: information leak from the sssd-sudo responder (CVE-2018-10852)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    This issue was discovered by Jakub Hrozek (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.

For Debian 8 'Jessie', these problems have been fixed in version 1.11.7-3+deb8u1.

We recommend that you upgrade your sssd packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198935	RHEL 5 : sssd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198927	RHEL 6 : sssd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196792	RHEL 5 : sssd (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
153144	Ubuntu 18.04 LTS / 20.04 LTS : SSSD vulnerabilities (USN-5067-1)	Nessus	Ubuntu Local Security Checks	high
127267	NewStart CGSL CORE 5.04 / MAIN 5.04 : sssd Vulnerability (NS-SA-2019-0067)	Nessus	NewStart CGSL Local Security Checks	high
124914	EulerOS Virtualization for ARM 64 3.0.1.0 : sssd (EulerOS-SA-2019-1411)	Nessus	Huawei Local Security Checks	high
123879	EulerOS Virtualization 2.5.4 : sssd (EulerOS-SA-2019-1193)	Nessus	Huawei Local Security Checks	high
123249	openSUSE Security Update : sssd (openSUSE-2019-574)	Nessus	SuSE Local Security Checks	high
122665	SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:0556-1)	Nessus	SuSE Local Security Checks	high
121360	Amazon Linux AMI : sssd (ALAS-2018-1127)	Nessus	Amazon Linux Local Security Checks	high
121159	SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:0081-1)	Nessus	SuSE Local Security Checks	high
121157	openSUSE Security Update : sssd (openSUSE-2019-51)	Nessus	SuSE Local Security Checks	high
120068	SUSE SLED15 / SLES15 Security Update : sssd (SUSE-SU-2018:2144-1)	Nessus	SuSE Local Security Checks	high
119918	EulerOS 2.0 SP2 : sssd (EulerOS-SA-2018-1429)	Nessus	Huawei Local Security Checks	high
119782	Amazon Linux 2 : sssd (ALAS-2018-1127)	Nessus	Amazon Linux Local Security Checks	high
119531	EulerOS 2.0 SP3 : sssd (EulerOS-SA-2018-1403)	Nessus	Huawei Local Security Checks	high
119200	Scientific Linux Security Update : sssd on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	high
118997	CentOS 7 : sssd (CESA-2018:3158)	Nessus	CentOS Local Security Checks	high
118776	Oracle Linux 7 : sssd (ELSA-2018-3158)	Nessus	Oracle Linux Local Security Checks	high
118533	RHEL 7 : sssd (RHSA-2018:3158)	Nessus	Red Hat Local Security Checks	high
111628	openSUSE Security Update : sssd (openSUSE-2018-847)	Nessus	SuSE Local Security Checks	high
111111	Debian DLA-1429-1 : sssd security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-10852

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high