CVE-2011-1758: Low severity fedora hosted sssd vulnerability
A flaw was introduced in SSSD 1.5.0 that, under certain conditions, would have sssd overwrite a cached password with the filename of the kerberos credential store (defined by krb5ccachetemplate in sssd.conf). This could allow an attacker to gain access to an account without knowing the password if they knew the cached-credential string.
This flaw does not affect earlier versions of SSSD that did not have support for automatic ticket renewal services.
Other sources
The krb5saveccnamedone function in providers/krb5/krb5auth.c in System Security Services Daemon (SSSD) 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by listing the /tmp directory to obtain the pathname.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1758?
CVE-2011-1758 is classified as a moderate severity vulnerability that could allow unauthorized access to accounts.
How do I fix CVE-2011-1758?
To fix CVE-2011-1758, upgrade SSSD to version 1.5.7 or later, where the vulnerability has been addressed.
Which versions of SSSD are affected by CVE-2011-1758?
CVE-2011-1758 affects SSSD versions 1.5.0 through 1.5.6.1 inclusive.
What condition leads to the vulnerability in CVE-2011-1758?
The vulnerability occurs when SSSD incorrectly overwrites a cached password with the filename of the Kerberos credential store.
Can CVE-2011-1758 be exploited remotely?
CVE-2011-1758 could potentially be exploited locally by an attacker with access to the system.