Synopsis: Moderate: sssd security and bug fix update
Advisory ID: SLSA-2017:3379-1
Issue Date: 2017-12-05
CVE Numbers: CVE-2017-12173
—
Security Fix(es):
* It was found that sssd’s sysdb_search_user_by_upn_res() function did not
sanitize requests when querying its local cache and was vulnerable to
injection. In a centralized login environment, if a password hash was
locally cached for a given user, an authenticated attacker could use this
flaw to retrieve it. (CVE-2017-12173)
Bug Fix(es):
* Previously, SSSD’s krb5 provider did not respect changed UIDs in ID
views overriding the default view. Consequently, Kerberos credential
caches were created with the incorrect, original UID, and processes of the
user were not able to find the changed UID. With this update, SSSD’s krb5
provider is made aware of the proper ID view name and respects the ID
override data. As a result, the Kerberos credential cache is now created
with the expected UID, and the processes can find it.
* Previously, the list of cache request domains was sometimes freed in the
middle of a cache request operation due to the refresh domains request, as
they both were using the same list. As a consequence, a segmentation fault
sometimes occurred in SSSD. With this update, SSSD uses a copy of the
cache request domains’ list for each cache request. As a result, SSSD no
longer crashes in this case.
* Previously, the calls provided by SSSD to send data to the Privilege
Attribute Certificate (PAC) responder did not use a mutex or any other
means to serialize access to the PAC responder from a single process. When
multithreaded applications overran the PAC responder with multiple
parallel requests, some threads did not receive a proper reply.
Consequently, such threads only resumed work after waiting 5 minutes for a
response. This update configures mutex to serialize access to the PAC
responder socket for multithreaded applications. As a result, all threads
now get a proper and timely reply.
—
SL7
x86_64
libipa_hbac-1.15.2-50.el7_4.8.i686.rpm
libipa_hbac-1.15.2-50.el7_4.8.x86_64.rpm
libsss_autofs-1.15.2-50.el7_4.8.x86_64.rpm
libsss_certmap-1.15.2-50.el7_4.8.i686.rpm
libsss_certmap-1.15.2-50.el7_4.8.x86_64.rpm
libsss_idmap-1.15.2-50.el7_4.8.i686.rpm
libsss_idmap-1.15.2-50.el7_4.8.x86_64.rpm
libsss_nss_idmap-1.15.2-50.el7_4.8.i686.rpm
libsss_nss_idmap-1.15.2-50.el7_4.8.x86_64.rpm
libsss_simpleifp-1.15.2-50.el7_4.8.i686.rpm
libsss_simpleifp-1.15.2-50.el7_4.8.x86_64.rpm
libsss_sudo-1.15.2-50.el7_4.8.x86_64.rpm
python-libipa_hbac-1.15.2-50.el7_4.8.x86_64.rpm
python-sss-1.15.2-50.el7_4.8.x86_64.rpm
python-sss-murmur-1.15.2-50.el7_4.8.x86_64.rpm
sssd-1.15.2-50.el7_4.8.x86_64.rpm
sssd-ad-1.15.2-50.el7_4.8.x86_64.rpm
sssd-client-1.15.2-50.el7_4.8.i686.rpm
sssd-client-1.15.2-50.el7_4.8.x86_64.rpm
sssd-common-1.15.2-50.el7_4.8.x86_64.rpm
sssd-common-pac-1.15.2-50.el7_4.8.x86_64.rpm
sssd-dbus-1.15.2-50.el7_4.8.x86_64.rpm
sssd-debuginfo-1.15.2-50.el7_4.8.i686.rpm
sssd-debuginfo-1.15.2-50.el7_4.8.x86_64.rpm
sssd-ipa-1.15.2-50.el7_4.8.x86_64.rpm
sssd-kcm-1.15.2-50.el7_4.8.x86_64.rpm
sssd-krb5-1.15.2-50.el7_4.8.x86_64.rpm
sssd-krb5-common-1.15.2-50.el7_4.8.x86_64.rpm
sssd-ldap-1.15.2-50.el7_4.8.x86_64.rpm
sssd-libwbclient-1.15.2-50.el7_4.8.x86_64.rpm
sssd-polkit-rules-1.15.2-50.el7_4.8.x86_64.rpm
sssd-proxy-1.15.2-50.el7_4.8.x86_64.rpm
sssd-tools-1.15.2-50.el7_4.8.x86_64.rpm
sssd-winbind-idmap-1.15.2-50.el7_4.8.x86_64.rpm
libipa_hbac-devel-1.15.2-50.el7_4.8.i686.rpm
libipa_hbac-devel-1.15.2-50.el7_4.8.x86_64.rpm
libsss_certmap-devel-1.15.2-50.el7_4.8.i686.rpm
libsss_certmap-devel-1.15.2-50.el7_4.8.x86_64.rpm
libsss_idmap-devel-1.15.2-50.el7_4.8.i686.rpm
libsss_idmap-devel-1.15.2-50.el7_4.8.x86_64.rpm
libsss_nss_idmap-devel-1.15.2-50.el7_4.8.i686.rpm
libsss_nss_idmap-devel-1.15.2-50.el7_4.8.x86_64.rpm
libsss_simpleifp-devel-1.15.2-50.el7_4.8.i686.rpm
libsss_simpleifp-devel-1.15.2-50.el7_4.8.x86_64.rpm
python-libsss_nss_idmap-1.15.2-50.el7_4.8.x86_64.rpm
sssd-libwbclient-devel-1.15.2-50.el7_4.8.i686.rpm
sssd-libwbclient-devel-1.15.2-50.el7_4.8.x86_64.rpm
sssd-1.15.2-50.el7_4.8.src.rpm
noarch
python-sssdconfig-1.15.2-50.el7_4.8.noarch.rpm
– Scientific Linux Development Team
