Date: Wed, 20 Mar 2013 08:57:34 -0600 From: Vincent Danen <vdanen@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE-2013-0287: sssd simple access provider flaw prevents intended ACL use when client to an AD provider This was posted to the linux-distros last week and as per the policy I'm posting it here now. Kaushik Banerjee discovered that SSSD's "simple" access provider did not work as expected when SSSD is configured as an Active Directory client when using the new (as of version 1.9.0) Active Directory provider. During the PAM account phase, SSSD may not not know the group name of a group that the user is a member of, but only the Windows Security Identifier. Because the group name is not known, the simple_deny_groups option does not work at all, and will always permit access; if any groups are noted in simple_deny_groups, all groups are permitted access. In addition, if any groups are noted in simple_allow_groups, access is always denied to everyone. By default, the configuration will allow all users to login (both simple_deny_groups and simple_allow_groups are empty). The Active Directory provider was introduced in version 1.9.0; earlier versions of SSSD are not vulnerable to this flaw. Acknowledgements: This issue was discovered by Kaushik Banerjee of Red Hat. References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0287 -- Vincent Danen / Red Hat Security Response Team Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.