RHEL 7 : sssd (RHSA-2015:2355)

medium Nessus Plugin ID 86983

Language:

Synopsis

The remote Red Hat host is missing a security update.

Description

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:2355 advisory.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms.

It was found that SSSD's Privilege Attribute Certificate (PAC) responder plug-in would leak a small amount of memory on each authentication request.
A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in.
(CVE-2015-5292)

The sssd packages have been upgraded to upstream version 1.13.0, which provides a number of bug fixes and enhancements over the previous version.
(BZ#1205554)

Several enhancements are described in the Red Hat Enterprise Linux 7.2 Release Notes, linked to in the References section:

* SSSD smart card support (BZ#854396)
* Cache authentication in SSSD (BZ#910187)
* SSSD supports overriding automatically discovered AD site (BZ#1163806)
* SSSD can now deny SSH access to locked accounts (BZ#1175760)
* SSSD enables UID and GID mapping on individual clients (BZ#1183747)
* Background refresh of cached entries (BZ#1199533)
* Multi-step prompting for one-time and long-term passwords (BZ#1200873)
* Caching for initgroups operations (BZ#1206575)

Bugs fixed:

* When the SELinux user content on an IdM server was set to an empty string, the SSSD SELinux evaluation utility returned an error. (BZ#1192314)

* If the ldap_child process failed to initialize credentials and exited with an error multiple times, operations that create files in some cases started failing due to an insufficient amount of i-nodes. (BZ#1198477)

* The SRV queries used a hard coded TTL timeout, and environments that wanted the SRV queries to be valid for a certain time only were blocked.
Now, SSSD parses the TTL value out of the DNS packet. (BZ#1199541)

* Previously, initgroups operation took an excessive amount of time. Now, logins and ID processing are faster for setups with AD back end and disabled ID mapping. (BZ#1201840)

* When an IdM client with Red Hat Enterprise Linux 7.1 or later was connecting to a server with Red Hat Enterprise Linux 7.0 or earlier, authentication with an AD trusted domain caused the sssd_be process to terminate unexpectedly. (BZ#1202170)

* If replication conflict entries appeared during HBAC processing, the user was denied access. Now, the replication conflict entries are skipped and users are permitted access. (BZ#1202245)

* The array of SIDs no longer contains an uninitialized value and SSSD no longer crashes. (BZ#1204203)

* SSSD supports GPOs from different domain controllers and no longer crashes when processing GPOs from different domain controllers.
(BZ#1205852)

* SSSD could not refresh sudo rules that contained groups with special characters, such as parentheses, in their name. (BZ#1208507)

* The IPA names are not qualified on the client side if the server already qualified them, and IdM group members resolve even if default_domain_suffix is used on the server side. (BZ#1211830)

* The internal cache cleanup task has been disabled by default to improve performance of the sssd_be process. (BZ#1212489)

* Now, default_domain_suffix is not considered anymore for autofs maps.
(BZ#1216285)

* The user can set subdomain_inherit=ignore_group-members to disable fetching group members for trusted domains. (BZ#1217350)

* The group resolution failed with an error message: Error: 14 (Bad address). The binary GUID handling has been fixed. (BZ#1226119)

Enhancements added:

* The description of default_domain_suffix has been improved in the manual pages. (BZ#1185536)

* With the new %0 template option, users on SSSD IdM clients can now use home directories set on AD. (BZ#1187103)

All sssd users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 86983

File Name: redhat-RHSA-2015-2355.nasl

Version: 2.12

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 11/20/2015

Updated: 4/15/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2015-5292

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:sssd-common-pac, p-cpe:/a:redhat:enterprise_linux:sssd-tools, p-cpe:/a:redhat:enterprise_linux:libsss_nss_idmap-devel, p-cpe:/a:redhat:enterprise_linux:sssd-krb5, p-cpe:/a:redhat:enterprise_linux:python-sss-murmur, p-cpe:/a:redhat:enterprise_linux:sssd-ad, p-cpe:/a:redhat:enterprise_linux:sssd-client, p-cpe:/a:redhat:enterprise_linux:sssd-dbus, p-cpe:/a:redhat:enterprise_linux:libsss_simpleifp, p-cpe:/a:redhat:enterprise_linux:libsss_idmap, p-cpe:/a:redhat:enterprise_linux:sssd-common, p-cpe:/a:redhat:enterprise_linux:sssd-ipa, p-cpe:/a:redhat:enterprise_linux:libsss_idmap-devel, p-cpe:/a:redhat:enterprise_linux:python-libsss_nss_idmap, p-cpe:/a:redhat:enterprise_linux:python-libipa_hbac, p-cpe:/a:redhat:enterprise_linux:sssd-libwbclient, p-cpe:/a:redhat:enterprise_linux:libipa_hbac-devel, p-cpe:/a:redhat:enterprise_linux:libsss_simpleifp-devel, p-cpe:/a:redhat:enterprise_linux:python-sss, p-cpe:/a:redhat:enterprise_linux:sssd-proxy, p-cpe:/a:redhat:enterprise_linux:libsss_nss_idmap, p-cpe:/a:redhat:enterprise_linux:sssd, p-cpe:/a:redhat:enterprise_linux:sssd-libwbclient-devel, p-cpe:/a:redhat:enterprise_linux:sssd-ldap, cpe:/o:redhat:enterprise_linux:7, p-cpe:/a:redhat:enterprise_linux:python-sssdconfig, p-cpe:/a:redhat:enterprise_linux:libipa_hbac, p-cpe:/a:redhat:enterprise_linux:sssd-krb5-common

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 11/19/2015

Vulnerability Publication Date: 10/29/2015

Reference Information

CVE: CVE-2015-5292

CWE: 401

RHSA: 2015:2355

Detections

Analytics