A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2177 advisory.

    - Resolves: rhbz#1660874 - CVE-2018-16838 sssd: improper implementation of                                GPOs due to too restrictive permissions [rhel-7]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3651 advisory.

    [2.2.0-19]
    - Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid                                new ones (kcm)

    [2.2.0-18]
    - Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
    - Also sync. kcm multihost tests with master

    [2.2.0-17]
    - Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome                                keyring
    - Also apply a patch to fix gating tests issue

    [2.2.0-16]
    - Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get                                the IP address of the machine updated in IPA upon                                sssd.service startup

    [2.2.0-15]
    - Resolves: rhbz#1736265 - Smart Card auth of local user: endless                                loop if wrong PIN was provided

    [2.2.0-14]
    - Resolves: rhbz#1736796 - sssd config option 'default_domain_suffix'                                should not cause files domain entries to be                                qualified, this can break sudo access

    [2.2.0-13]
    - Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the                 systemd-user service in the account phase in RHEL-8

    [2.2.0-12]
    - Resolves: rhbz#1448094 - sssd-kcm cannot handle big tickets

    [2.2.0-11]
    - Resolves: rhbz#1733372 - permission denied on logs when running sssd as                                non-root user

    [2.2.0-10]
    - Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing                                the trailing colon

    [2.2.0-9]
    - Resolves: rhbz#1382750 - Conflicting default timeout values

    [2.2.0-8]
    - Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder                                repository
                             - This just required a raise in release number                                and changelog for the record.

    [2.2.0-7]
    - Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is                                not FIPS140 compliant

    [2.2.0-6]
    - Resolves: rhbz#1726945 - negative cache does not use values from                                'filter_users' config option for known domains

    [2.2.0-5]
    - Resolves: rhbz#1729055 - sssd does not pass correct rules to sudo

    [2.2.0-4]
    - Resolves: rhbz#1283798 - sssd failover does not work on connecting to                                non-responsive ldaps:// server

    [2.2.0-3]
    - Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with                                no members

    [2.2.0-2]
    - Resolves: rhbz#1673443 - sssd man pages: The default value of                                'ldap_user_home_directory' is not mentioned                                with AD server configuration

    [2.2.0-1]
    - Resolves: rhbz#1687281       Rebase sssd in RHEL-8.1 to the latest upstream release

    [2.1.0-1]
    - Resolves: rhbz#1687281       Rebase sssd in RHEL-8.1 to the latest upstream release

    [2.0.0-45]
    - Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is       done here in order to unblock gating changes before rebase.
    - Related: rhbz#1682305

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3436 advisory.

  - A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to     a too strict permission settings on the server side, SSSD will allow all authenticated users to login     instead of denying access. (CVE-2018-16838)

  - A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services     that restrict the user's filesystem access to within their home directory through chroot() etc. All     versions before 2.1 are vulnerable. (CVE-2019-3811)

  - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-     fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a     specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3621)

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5067-1 advisory.

    Jakub Hrozek discovered that SSSD incorrectly handled file permissions. A local attacker could possibly     use this issue to read the sudo rules available for any user. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2018-10852)

    It was discovered that SSSD incorrectly handled Group Policy Objects. When SSSD is configured with too     strict permissions causing the GPO to not be readable, SSSD will allow all authenticated users to login     instead of being denied, contrary to expectations. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2018-16838)

    It was discovered that SSSD incorrectly handled users with no home directory set. When no home directory     was set, SSSD would return the root directory instead of an empty string, possibly bypassing security     measures. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3811)

    Cedric Buissart discovered that SSSD incorrectly handled the sssctl command. In certain environments, a     local user could use this issue to execute arbitrary commands and possibly escalate privileges.
    (CVE-2021-3621)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3651 advisory.

  - sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in sssd Group Policy Objects     implementation. When the GPO is not readable by SSSD     due to a too strict permission settings on the server     side, SSSD will allow all authenticated users to login     instead of denying access.(CVE-2018-16838)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sssd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in sssd Group Policy Objects     implementation. When the GPO is not readable by SSSD     due to a too strict permission settings on the server     side, SSSD will allow all authenticated users to login     instead of denying access.(CVE-2018-16838)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has sssd packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in sssd. If a user was     configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string     / no home directory). This could impact services that     restrict the user's filesystem access to within their     home directory through chroot() etc. All versions before     2.1 are vulnerable. (CVE-2019-3811)

  - A flaw was found in sssd Group Policy Objects     implementation. When the GPO is not readable by SSSD due     to a too strict permission settings on the server side,     SSSD will allow all authenticated users to login instead     of denying access. (CVE-2018-16838)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in sssd Group Policy Objects     implementation. When the GPO is not readable by SSSD     due to a too strict permission settings on the server     side, SSSD will allow all authenticated users to login     instead of denying access.(CVE-2018-16838)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3651 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    The following packages have been upgraded to a later upstream version: sssd (2.2.0). (BZ#1687281)

    Security Fix(es):

    * sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.(CVE-2018-16838)

A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot().(CVE-2019-3811)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sssd packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in sssd. If a user was     configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string     / no home directory). This could impact services that     restrict the user's filesystem access to within their     home directory through chroot() etc. All versions before     2.1 are vulnerable. (CVE-2019-3811)

  - A flaw was found in sssd Group Policy Objects     implementation. When the GPO is not readable by SSSD due     to a too strict permission settings on the server side,     SSSD will allow all authenticated users to login instead     of denying access. (CVE-2018-16838)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for sssd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

The following packages have been upgraded to a later upstream version:
sssd (1.16.4). (BZ#1658994)

Security Fix(es) :

* sssd: fallback_homedir returns '/' for empty home directories in passwd file (CVE-2019-3811)

* sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
sssd (1.16.4).

Security Fix(es) :

  - sssd: fallback_homedir returns '/' for empty home     directories in passwd file (CVE-2019-3811)

  - sssd: improper implementation of GPOs due to too     restrictive permissions (CVE-2018-16838)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2437 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The following packages have been upgraded to a later upstream version: imgbased (1.1.9), ovirt-node-ng     (4.3.5), redhat-release-virtualization-host (4.3.5), redhat-virtualization-host (4.3.5). (BZ#1669357,     BZ#1669365, BZ#1684986, BZ#1711193, BZ#1717250, BZ#1726917)

    Security Fix(es):

    * python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc     (CVE-2019-10160)

    * rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled (CVE-2018-16881)

    * edk2: stack overflow in XHCI causing denial of service (CVE-2019-0161)

    * openssl: 0-byte record padding oracle (CVE-2019-1559)

    * cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment     (CVE-2019-10139)

    * sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2177 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    The following packages have been upgraded to a later upstream version: sssd (1.16.4). (BZ#1658994)

    Security Fix(es):

    * sssd: fallback_homedir returns '/' for empty home directories in passwd file (CVE-2019-3811)

    * sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for sssd fixes the following issues :

Security issue fixed :

  - CVE-2018-16838: Fixed an authentication bypass related     to the Group Policy Objects implementation     (bsc#1124194). 

Non-security issues fixed :

  - Allow defaults sudoRole without sudoUser attribute     (bsc#1135247)

  - Missing GPOs directory could have led to login problems     (bsc#1132879)

  - Fix a crash by adding a netgroup counter to struct     nss_enum_index (bsc#1132657)

This update was imported from the SUSE:SLE-15:Update update project.

This update for sssd fixes the following issues :

Security issue fixed :

  - CVE-2018-16838: Fixed an authentication bypass related     to the Group Policy Objects implementation     (bsc#1124194).

Non-security issue fixed :

  - Create directory to download and cache GPOs     (bsc#1132879)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for sssd fixes the following issues :

Security issue fixed :

CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation (bsc#1124194)

Non-security issues fixed: Missing GPOs directory could have led to login problems (bsc#1132879)

Fix a crash by adding a netgroup counter to struct nss_enum_index (bsc#1132657)

Allow defaults sudoRole without sudoUser attribute (bsc#1135247)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sssd fixes the following issues :

Security issue fixed :

CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation (bsc#1124194).

Non-security issue fixed: Create directory to download and cache GPOs (bsc#1132879)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sssd fixes the following issues :

Security issue fixed :

CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation (bsc#1124194).

Non-security issues fixed: Allow defaults sudoRole without sudoUser attribute (bsc#1135247)

Missing GPOs directory could have led to login problems (bsc#1132879)

Fix a crash by adding a netgroup counter to struct nss_enum_index (bsc#1132657)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180772	Oracle Linux 7 : sssd (ELSA-2019-2177)	Nessus	Oracle Linux Local Security Checks	medium
180642	Oracle Linux 8 : sssd (ELSA-2019-3651)	Nessus	Oracle Linux Local Security Checks	medium
176457	Debian DLA-3436-1 : sssd - LTS security update	Nessus	Debian Local Security Checks	high
153144	Ubuntu 18.04 LTS / 20.04 LTS : SSSD vulnerabilities (USN-5067-1)	Nessus	Ubuntu Local Security Checks	high
145606	CentOS 8 : sssd (CESA-2019:3651)	Nessus	CentOS Local Security Checks	medium
135615	EulerOS Virtualization 3.0.2.2 : sssd (EulerOS-SA-2020-1453)	Nessus	Huawei Local Security Checks	medium
134498	EulerOS Virtualization for ARM 64 3.0.2.0 : sssd (EulerOS-SA-2020-1209)	Nessus	Huawei Local Security Checks	medium
132447	NewStart CGSL CORE 5.05 / MAIN 5.05 : sssd Multiple Vulnerabilities (NS-SA-2019-0241)	Nessus	NewStart CGSL Local Security Checks	medium
132202	EulerOS 2.0 SP3 : sssd (EulerOS-SA-2019-2667)	Nessus	Huawei Local Security Checks	medium
131670	EulerOS 2.0 SP2 : sssd (EulerOS-SA-2019-2517)	Nessus	Huawei Local Security Checks	medium
130652	EulerOS 2.0 SP5 : sssd (EulerOS-SA-2019-2190)	Nessus	Huawei Local Security Checks	medium
130562	RHEL 8 : sssd (RHSA-2019:3651)	Nessus	Red Hat Local Security Checks	medium
130402	Amazon Linux 2 : sssd (ALAS-2019-1343)	Nessus	Amazon Linux Local Security Checks	medium
129890	NewStart CGSL CORE 5.04 / MAIN 5.04 : sssd Multiple Vulnerabilities (NS-SA-2019-0195)	Nessus	NewStart CGSL Local Security Checks	medium
129797	Amazon Linux AMI : sssd (ALAS-2019-1307)	Nessus	Amazon Linux Local Security Checks	medium
128370	CentOS 7 : sssd (CESA-2019:2177)	Nessus	CentOS Local Security Checks	medium
128264	Scientific Linux Security Update : sssd on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	medium
127986	RHEL 7 : Red Hat Virtualization (RHSA-2019:2437)	Nessus	Red Hat Local Security Checks	critical
127691	RHEL 7 : sssd (RHSA-2019:2177)	Nessus	Red Hat Local Security Checks	medium
126060	openSUSE Security Update : sssd (openSUSE-2019-1589)	Nessus	SuSE Local Security Checks	medium
126037	openSUSE Security Update : sssd (openSUSE-2019-1576)	Nessus	SuSE Local Security Checks	medium
125876	SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:1480-1)	Nessus	SuSE Local Security Checks	medium
125875	SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:1477-1)	Nessus	SuSE Local Security Checks	medium
125874	SUSE SLED15 / SLES15 Security Update : sssd (SUSE-SU-2019:1476-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-16838

medium

Tenable Plugins

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium