CVE-2010-0014: Low severity fedora hosted sssd vulnerability
System Security Services Daemon (SSSD) before 1.0.1, when the krb5 authprovider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting ticket (TGT); and might allow remote attackers to bypass intended access restrictions via vectors involving an arbitrary password in conjunction with a valid TGT.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0014?
CVE-2010-0014 is rated as a medium severity vulnerability.
How do I fix CVE-2010-0014?
To fix CVE-2010-0014, upgrade to SSSD version 1.0.1 or later.
What types of attacks does CVE-2010-0014 enable?
CVE-2010-0014 enables physically proximate attackers to authenticate using arbitrary passwords.
Which versions of SSSD are affected by CVE-2010-0014?
SSSD versions prior to 1.0.1, including 0.5.0, 0.3.1, and others listed, are affected by CVE-2010-0014.
What specific component is vulnerable in CVE-2010-0014?
CVE-2010-0014 affects the screen-locking program of SSSD when the krb5 auth_provider is configured without an accessible KDC.