Detections
Analytics

CentOS 7 : sssd (CESA-2015:2355)

medium Nessus Plugin ID 87151

Language:

Synopsis

The remote CentOS host is missing one or more security updates.

Description

Updated sssd packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms.

It was found that SSSD's Privilege Attribute Certificate (PAC) responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in. (CVE-2015-5292)

The sssd packages have been upgraded to upstream version 1.13.0, which provides a number of bug fixes and enhancements over the previous version. (BZ#1205554)

Several enhancements are described in the Red Hat Enterprise Linux 7.2 Release Notes, linked to in the References section :

* SSSD smart card support (BZ#854396)

* Cache authentication in SSSD (BZ#910187)

* SSSD supports overriding automatically discovered AD site (BZ#1163806)

* SSSD can now deny SSH access to locked accounts (BZ#1175760)

* SSSD enables UID and GID mapping on individual clients (BZ#1183747)

* Background refresh of cached entries (BZ#1199533)

* Multi-step prompting for one-time and long-term passwords (BZ#1200873)

* Caching for initgroups operations (BZ#1206575)

Bugs fixed :

* When the SELinux user content on an IdM server was set to an empty string, the SSSD SELinux evaluation utility returned an error.
(BZ#1192314)

* If the ldap_child process failed to initialize credentials and exited with an error multiple times, operations that create files in some cases started failing due to an insufficient amount of i-nodes.
(BZ#1198477)

* The SRV queries used a hard-coded TTL timeout, and environments that wanted the SRV queries to be valid for a certain time only were blocked. Now, SSSD parses the TTL value out of the DNS packet.
(BZ#1199541)

* Previously, initgroups operation took an excessive amount of time.
Now, logins and ID processing are faster for setups with AD back end and disabled ID mapping. (BZ#1201840)

* When an IdM client with Red Hat Enterprise Linux 7.1 or later was connecting to a server with Red Hat Enterprise Linux 7.0 or earlier, authentication with an AD trusted domain caused the sssd_be process to terminate unexpectedly. (BZ#1202170)

* If replication conflict entries appeared during HBAC processing, the user was denied access. Now, the replication conflict entries are skipped and users are permitted access. (BZ#1202245)

* The array of SIDs no longer contains an uninitialized value and SSSD no longer crashes. (BZ#1204203)

* SSSD supports GPOs from different domain controllers and no longer crashes when processing GPOs from different domain controllers.
(BZ#1205852)

* SSSD could not refresh sudo rules that contained groups with special characters, such as parentheses, in their name. (BZ#1208507)

* The IPA names are not qualified on the client side if the server already qualified them, and IdM group members resolve even if default_domain_suffix is used on the server side. (BZ#1211830)

* The internal cache cleanup task has been disabled by default to improve performance of the sssd_be process. (BZ#1212489)

* Now, default_domain_suffix is not considered anymore for autofs maps. (BZ#1216285)

* The user can set subdomain_inherit=ignore_group-members to disable fetching group members for trusted domains. (BZ#1217350)

* The group resolution failed with an error message: 'Error: 14 (Bad address)'. The binary GUID handling has been fixed. (BZ#1226119)

Enhancements added :

* The description of default_domain_suffix has been improved in the manual pages. (BZ#1185536)

* With the new '%0' template option, users on SSSD IdM clients can now use home directories set on AD. (BZ#1187103)

All sssd users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

Solution

Update the affected sssd packages.

See Also

http://www.nessus.org/u?68582f38

Plugin Details

Severity: Medium

ID: 87151

File Name: centos_RHSA-2015-2355.nasl

Version: 2.9

Type: local

Agent: unix

Published: 12/2/2015

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2015-5292

Vulnerability Information

CPE: p-cpe:/a:centos:centos:libsss_simpleifp, p-cpe:/a:centos:centos:python-sss, p-cpe:/a:centos:centos:python-libipa_hbac, p-cpe:/a:centos:centos:sssd-krb5-common, p-cpe:/a:centos:centos:libipa_hbac, p-cpe:/a:centos:centos:libsss_nss_idmap, p-cpe:/a:centos:centos:python-libsss_nss_idmap, p-cpe:/a:centos:centos:sssd-libwbclient, p-cpe:/a:centos:centos:libsss_idmap-devel, p-cpe:/a:centos:centos:sssd-krb5, p-cpe:/a:centos:centos:libsss_idmap, p-cpe:/a:centos:centos:sssd, p-cpe:/a:centos:centos:libsss_simpleifp-devel, p-cpe:/a:centos:centos:sssd-common-pac, p-cpe:/a:centos:centos:sssd-ipa, cpe:/o:centos:centos:7, p-cpe:/a:centos:centos:sssd-ldap, p-cpe:/a:centos:centos:python-sss-murmur, p-cpe:/a:centos:centos:sssd-client, p-cpe:/a:centos:centos:sssd-dbus, p-cpe:/a:centos:centos:libsss_nss_idmap-devel, p-cpe:/a:centos:centos:sssd-libwbclient-devel, p-cpe:/a:centos:centos:sssd-ad, p-cpe:/a:centos:centos:libipa_hbac-devel, p-cpe:/a:centos:centos:python-sssdconfig, p-cpe:/a:centos:centos:sssd-proxy, p-cpe:/a:centos:centos:sssd-tools, p-cpe:/a:centos:centos:sssd-common

Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/30/2015

Vulnerability Publication Date: 10/29/2015

Reference Information

CVE: CVE-2015-5292

RHSA: 2015:2355