Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 20 Mar 2013 08:57:34 -0600
From: Vincent Danen <>
Subject: CVE-2013-0287: sssd simple access provider flaw prevents intended
 ACL use when client to an AD provider

This was posted to the linux-distros last week and as per the policy I'm
posting it here now.

Kaushik Banerjee discovered that SSSD's "simple" access provider did not
work as expected when SSSD is configured as an Active Directory client
when using the new (as of version 1.9.0) Active Directory provider.
During the PAM account phase, SSSD may not not know the group name of a
group that the user is a member of, but only the Windows Security
Identifier.  Because the group name is not known, the simple_deny_groups
option does not work at all, and will always permit access; if any
groups are noted in simple_deny_groups, all groups are permitted access.
In addition, if any groups are noted in simple_allow_groups, access is
always denied to everyone.

By default, the configuration will allow all users to login (both
simple_deny_groups and simple_allow_groups are empty).

The Active Directory provider was introduced in version 1.9.0; earlier
versions of SSSD are not vulnerable to this flaw.


This issue was discovered by Kaushik Banerjee of Red Hat.


Vincent Danen / Red Hat Security Response Team 

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.