The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3379 advisory.

    [1.15.2-50.8]
    - Resolves: rhbz#1508972 - Accessing IdM kerberos ticket fails while id                                mapping is applied [rhel-7.4.z]
    - Resolves: rhbz#1509177 - Race condition between refreshing the cr_domain                                list and a request that is using the list can                                cause a segfault is sssd_nss [rhel-7.4.z]

    [1.15.2-50.7]
    - Resolves: rhbz#1506142 - SSSD can crash due to ABI changes in                                libldb >= 1.2.0 (1.1.30) [rhel-7.4.z]
    - Resolves: rhbz#1506682 - sssd_client: add mutex protected call to the                                PAC responder [rhel-7.4.z]
    - Resolves: rhbz#1499658 - CVE-2017-12173 sssd: unsanitized input when                                searching in local cache database [rhel-7.4.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 7 : sssd (ELSA-2017-3379)

high Nessus Plugin ID 105016

Version 3.9

Version 3.8

Version 3.9 Nov 1, 2024, 11:44 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202411012344
Version 3.8 Oct 23, 2024, 3:11 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 score source (set to "CVE-2017-12173") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202410230311