CVE-2010-2940: Medium severity fedoraproject Sssd vulnerability
Ted Brunell reported that SSSD, when authenticating against an LDAP server that allows unauthenticated binds, would authenticate users providing an empty password to any service using pamauthenticate (such as the GNOME screensaver). This could allow a local or remote attacker to gain access to an account without knowing the victim's password.
This flaw can only be exploited if the directory server allows unauthenticated binds, because the directory server will return that the bind was successful if no password is provided.
Acknowledgements:
Red Hat would like to thank Ted Brunell for reporting this issue.
Other sources
The authsend function in providers/ldap/ldapauth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pamauthenticate via an empty password.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2940?
CVE-2010-2940 is considered a medium severity vulnerability due to the potential for unauthorized access.
How do I fix CVE-2010-2940?
To fix CVE-2010-2940, update SSSD to a version later than 1.3.0 that addresses the unauthenticated bind issue.
What systems are affected by CVE-2010-2940?
CVE-2010-2940 primarily affects SSSD versions 1.3.0 and those configured with LDAP servers allowing unauthenticated binds.
What type of attacks can exploit CVE-2010-2940?
CVE-2010-2940 can be exploited by local or remote attackers to authenticate users with an empty password.
What services can be affected by CVE-2010-2940?
Services using pam_authenticate, such as the GNOME screensaver, can be affected by CVE-2010-2940.