Date: Wed, 25 Mar 2015 16:36:52 -0400 (EDT) From: cve-assign@...re.org To: krahmer@...e.de Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVS-Request: realmd code execution/auth bypass -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Upstream has opened two bugs for issues in realmd This initial response has a CVE ID only for the second one. > could lead to remote attackers logging into the local system > by placing an evil AD server in the LAN > https://bugs.freedesktop.org/show_bug.cgi?id=89205 Is upstream planning to announce this as a vulnerability fix? Although the old behavior was unsafe if there was any possibility of an untrusted device on the LAN, it appears that the old behavior had been intentional. For example, the old behavior may have been chosen as a security/convenience tradeoff. This example might be applicable: https://fedoraproject.org/wiki/QA:Testcase_realmd_join_automatic > could lead to remote attackers logging into the local system by > offering \r in LDAP responses that are treated by sssd and winbind as > newline separator; therefore allowing to smuggle options into the > config files used for startup > https://bugs.freedesktop.org/show_bug.cgi?id=89207 > No data that was retrieved before join ... should be used when > configuring sssd.conf and/or smb.conf. Use CVE-2015-2704. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVExugAAoJEKllVAevmvmsjMkIAJ50zsMP++L4lIXkp7U004Yf u6+e0GUl9EHTAhbF3vT8XMqcpPN3EKmG9TFMTBQUQ1NhofQ3WhZsvXnbFV2nsDz1 e7SC+gk21IejoRbCxZjgLKLYv3WaPz46Lzfd61UjgMAxCOvx8c0QvmrF1tSoS/8h PCU1prMYhEUdTOdlVU0TQ73FKVMyjJl5KyiVG3WmLwHxloUsYnJKCGLByu8oiG7B BSafuVQUPKp3EROUBqGubLKjojGWv48Jp2D4EAJWVnuB2gwqab1Vzvrr7uOiVYNZ jtjkzoH9r6BK1DiWE7MGQFlvDTp1XY5MClYnq7dLC0RKRJtXy05UeFFxYvwsjsI= =QaAk -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ