A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sssd: information leak from the sssd-sudo responder (CVE-2018-10852)

  - sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to     the allowed_uids configuration parameter. If sensitive information were stored in the user directory,     this could be inadvertently disclosed to local attackers. (CVE-2018-16883)

  - A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services     that restrict the user's filesystem access to within their home directory through chroot() etc. All     versions before 2.1 are vulnerable. (CVE-2019-3811)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2177 advisory.

    - Resolves: rhbz#1660874 - CVE-2018-16838 sssd: improper implementation of                                GPOs due to too restrictive permissions [rhel-7]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3436 advisory.

  - A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to     a too strict permission settings on the server side, SSSD will allow all authenticated users to login     instead of denying access. (CVE-2018-16838)

  - A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services     that restrict the user's filesystem access to within their home directory through chroot() etc. All     versions before 2.1 are vulnerable. (CVE-2019-3811)

  - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-     fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a     specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3621)

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5067-1 advisory.

    Jakub Hrozek discovered that SSSD incorrectly handled file permissions. A local attacker could possibly     use this issue to read the sudo rules available for any user. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2018-10852)

    It was discovered that SSSD incorrectly handled Group Policy Objects. When SSSD is configured with too     strict permissions causing the GPO to not be readable, SSSD will allow all authenticated users to login     instead of being denied, contrary to expectations. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2018-16838)

    It was discovered that SSSD incorrectly handled users with no home directory set. When no home directory     was set, SSSD would return the root directory instead of an empty string, possibly bypassing security     measures. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3811)

    Cedric Buissart discovered that SSSD incorrectly handled the sssctl command. In certain environments, a     local user could use this issue to execute arbitrary commands and possibly escalate privileges.
    (CVE-2021-3621)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has sssd packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in sssd. If a user was     configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string     / no home directory). This could impact services that     restrict the user's filesystem access to within their     home directory through chroot() etc. All versions before     2.1 are vulnerable. (CVE-2019-3811)

  - A flaw was found in sssd Group Policy Objects     implementation. When the GPO is not readable by SSSD due     to a too strict permission settings on the server side,     SSSD will allow all authenticated users to login instead     of denying access. (CVE-2018-16838)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.(CVE-2018-16838)

A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot().(CVE-2019-3811)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sssd packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in sssd. If a user was     configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string     / no home directory). This could impact services that     restrict the user's filesystem access to within their     home directory through chroot() etc. All versions before     2.1 are vulnerable. (CVE-2019-3811)

  - A flaw was found in sssd Group Policy Objects     implementation. When the GPO is not readable by SSSD due     to a too strict permission settings on the server side,     SSSD will allow all authenticated users to login instead     of denying access. (CVE-2018-16838)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A vulnerability was found in sssd where, if a user was     configured with no home directory set, sssd would     return '/' (the root directory) instead of '' (the     empty string / no home directory). This could impact     services that restrict the user's filesystem access to     within their home directory through     chroot().(CVE-2019-3811)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for sssd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

The following packages have been upgraded to a later upstream version:
sssd (1.16.4). (BZ#1658994)

Security Fix(es) :

* sssd: fallback_homedir returns '/' for empty home directories in passwd file (CVE-2019-3811)

* sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
sssd (1.16.4).

Security Fix(es) :

  - sssd: fallback_homedir returns '/' for empty home     directories in passwd file (CVE-2019-3811)

  - sssd: improper implementation of GPOs due to too     restrictive permissions (CVE-2018-16838)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2177 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    The following packages have been upgraded to a later upstream version: sssd (1.16.4). (BZ#1658994)

    Security Fix(es):

    * sssd: fallback_homedir returns '/' for empty home directories in passwd file (CVE-2019-3811)

    * sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the sssd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A vulnerability was found in sssd where, if a user was     configured with no home directory set, sssd would     return '/' (the root directory) instead of '' (the     empty string / no home directory). This could impact     services that restrict the user's filesystem access to     within their home directory through     chroot().(CVE-2019-3811)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for adcli and sssd provides the following improvement :

Security vulnerability fixed :

  - CVE-2019-3811: Fix fallback_homedir returning '/' for     empty home directories (bsc#1121759)

Other fixes :

  - Add an option to disable checking for trusted domains in     the subdomains provider (bsc#1125617)

  - Clear pid file in corner cases (bsc#1127670)

  - Fix child unable to write to log file after SIGHUP     (bsc#1127670)

  - Include adcli in SUSE Linux Enterprise 12 SP3 for     sssd-ad. (fate#326619, bsc#1109849)

The adcli enables sssd to do password renewal when using Active Directory. This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for adcli and sssd provides the following improvement :

Security vulnerability fixed :

CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759)

Other fixes: Add an option to disable checking for trusted domains in the subdomains provider (bsc#1125617)

Clear pid file in corner cases (bsc#1127670)

Fix child unable to write to log file after SIGHUP (bsc#1127670)

Include adcli in SUSE Linux Enterprise 12 SP3 for sssd-ad.
(fate#326619, bsc#1109849)

The adcli enables sssd to do password renewal when using Active Directory.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sssd fixes the following issues :

Security vulnerability addresed :

  - CVE-2019-3811: Fix fallback_homedir returning '/' for     empty home directories (bsc#1121759)

Other bug fixes and changes :

  - Install logrotate configuration (bsc#1004220)

  - Align systemd service file with upstream, run     interactive and change service type to notify     (bsc#1120852)

  - Fix sssd not starting in foreground mode (bsc#1125277)

  - Strip whitespaces in netgroup triples (bsc#1087320)

This update was imported from the SUSE:SLE-15:Update update project.

This update for sssd fixes the following issues :

Security vulnerabilities addressed :

Fix fallback_homedir returning '/' for empty home directories (CVE-2019-3811) (bsc#1121759)

Create sockets with right permissions (bsc#1098377, CVE-2018-10852)

Other bug fixes and changes: Install logrotate configuration (bsc#1004220)

Strip whitespaces in netgroup triples (bsc#1087320)

Align systemd service file with upstream

  - Run interactive and change service type to notify     (bsc#1120852)

  - Replace deprecated '-f' and use '--logger'

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sssd fixes the following issues :

Security vulnerability fixed :

CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759)

Other bug fixes and changes: Skip sdap_save_grpmem() if ignore_group_members is set. (bsc#1082568)

Only search for primary group if it is not already cached (bsc#1082568)

Install /var/lib/sss/mc directory to correct sssd cache invalidation behaviour. Spec patch authored by Josef Cejka. (bsc#1039567) to fix a segfault in sudo provider (bsc#977224).

Fix a segfault in sss_cache (bsc#976038).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sssd fixes the following issues :

Security vulnerability addresed :

CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759)

Other bug fixes and changes: Install logrotate configuration (bsc#1004220)

Align systemd service file with upstream, run interactive and change service type to notify (bsc#1120852)

Fix sssd not starting in foreground mode (bsc#1125277)

Strip whitespaces in netgroup triples (bsc#1087320)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc.

For Debian 8 'Jessie', this problem has been fixed in version 1.11.7-3+deb8u2.

We recommend that you upgrade your sssd packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198927	RHEL 6 : sssd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
180772	Oracle Linux 7 : sssd (ELSA-2019-2177)	Nessus	Oracle Linux Local Security Checks	medium
176457	Debian DLA-3436-1 : sssd - LTS security update	Nessus	Debian Local Security Checks	high
153144	Ubuntu 18.04 LTS / 20.04 LTS : SSSD vulnerabilities (USN-5067-1)	Nessus	Ubuntu Local Security Checks	high
132447	NewStart CGSL CORE 5.05 / MAIN 5.05 : sssd Multiple Vulnerabilities (NS-SA-2019-0241)	Nessus	NewStart CGSL Local Security Checks	medium
130402	Amazon Linux 2 : sssd (ALAS-2019-1343)	Nessus	Amazon Linux Local Security Checks	medium
129890	NewStart CGSL CORE 5.04 / MAIN 5.04 : sssd Multiple Vulnerabilities (NS-SA-2019-0195)	Nessus	NewStart CGSL Local Security Checks	medium
129797	Amazon Linux AMI : sssd (ALAS-2019-1307)	Nessus	Amazon Linux Local Security Checks	medium
129245	EulerOS 2.0 SP3 : sssd (EulerOS-SA-2019-2052)	Nessus	Huawei Local Security Checks	medium
128370	CentOS 7 : sssd (CESA-2019:2177)	Nessus	CentOS Local Security Checks	medium
128264	Scientific Linux Security Update : sssd on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	medium
127691	RHEL 7 : sssd (RHSA-2019:2177)	Nessus	Red Hat Local Security Checks	medium
126881	EulerOS 2.0 SP2 : sssd (EulerOS-SA-2019-1754)	Nessus	Huawei Local Security Checks	medium
126543	EulerOS Virtualization for ARM 64 3.0.2.0 : sssd (EulerOS-SA-2019-1701)	Nessus	Huawei Local Security Checks	medium
126296	EulerOS 2.0 SP5 : sssd (EulerOS-SA-2019-1669)	Nessus	Huawei Local Security Checks	medium
126287	EulerOS 2.0 SP8 : sssd (EulerOS-SA-2019-1660)	Nessus	Huawei Local Security Checks	medium
123991	openSUSE Security Update : sssd (openSUSE-2019-1174)	Nessus	SuSE Local Security Checks	medium
123549	SUSE SLED12 / SLES12 Security Update : Recommended update for adcli, sssd (SUSE-SU-2019:0805-1)	Nessus	SuSE Local Security Checks	medium
122941	openSUSE Security Update : sssd (openSUSE-2019-344)	Nessus	SuSE Local Security Checks	medium
122665	SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:0556-1)	Nessus	SuSE Local Security Checks	high
122663	SUSE SLES12 Security Update : sssd (SUSE-SU-2019:0552-1)	Nessus	SuSE Local Security Checks	medium
122645	SUSE SLED15 / SLES15 Security Update : sssd (SUSE-SU-2019:0542-1)	Nessus	SuSE Local Security Checks	medium
121233	Debian DLA-1635-1 : sssd security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-3811

medium

Tenable Plugins

high

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium