CVE-2013-0219: Race Condition
First published: Wed Dec 05 2012(Updated: )
A TOCTOU (time-of-check time-of-use) race condition was found in the way SSSD, System Security Services Daemon, performed copying and removal of (user) directory trees.A local attacker, with permissions to write into directory of the victim, being actively / currently copied / removed via the sssd daemon facility, could use this flaw to conduct symbolic link attacks, leading to their ability to alter / remove directories outside of originally intended, to be modified, directory tree. This issue was found by Florian Weimer of Red Hat Product Security Team.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fedoraproject Sssd | <=1.9.3 | |
| Fedoraproject Sssd | =0.2.1 | |
| Fedoraproject Sssd | =0.3.0 | |
| Fedoraproject Sssd | =0.3.1 | |
| Fedoraproject Sssd | =0.3.2 | |
| Fedoraproject Sssd | =0.3.3 | |
| Fedoraproject Sssd | =0.4.0 | |
| Fedoraproject Sssd | =0.4.1 | |
| Fedoraproject Sssd | =0.5.0 | |
| Fedoraproject Sssd | =0.6.0 | |
| Fedoraproject Sssd | =0.6.1 | |
| Fedoraproject Sssd | =0.7.0 | |
| Fedoraproject Sssd | =0.7.1 | |
| Fedoraproject Sssd | =0.99.0 | |
| Fedoraproject Sssd | =0.99.1 | |
| Fedoraproject Sssd | =1.0.0 | |
| Fedoraproject Sssd | =1.0.1 | |
| Fedoraproject Sssd | =1.0.2 | |
| Fedoraproject Sssd | =1.0.3 | |
| Fedoraproject Sssd | =1.0.4 | |
| Fedoraproject Sssd | =1.0.5 | |
| Fedoraproject Sssd | =1.0.6 | |
| Fedoraproject Sssd | =1.0.99 | |
| Fedoraproject Sssd | =1.1.0 | |
| Fedoraproject Sssd | =1.1.1 | |
| Fedoraproject Sssd | =1.1.2 | |
| Fedoraproject Sssd | =1.1.91 | |
| Fedoraproject Sssd | =1.1.92 | |
| Fedoraproject Sssd | =1.2.0 | |
| Fedoraproject Sssd | =1.2.1 | |
| Fedoraproject Sssd | =1.2.2 | |
| Fedoraproject Sssd | =1.2.3 | |
| Fedoraproject Sssd | =1.2.4 | |
| Fedoraproject Sssd | =1.2.91 | |
| Fedoraproject Sssd | =1.3.0 | |
| Fedoraproject Sssd | =1.3.1 | |
| Fedoraproject Sssd | =1.4.0 | |
| Fedoraproject Sssd | =1.4.1 | |
| Fedoraproject Sssd | =1.5.0 | |
| Fedoraproject Sssd | =1.5.1 | |
| Fedoraproject Sssd | =1.5.2 | |
| Fedoraproject Sssd | =1.5.3 | |
| Fedoraproject Sssd | =1.5.4 | |
| Fedoraproject Sssd | =1.5.5 | |
| Fedoraproject Sssd | =1.5.6 | |
| Fedoraproject Sssd | =1.5.6.1 | |
| Fedoraproject Sssd | =1.5.7 | |
| Fedoraproject Sssd | =1.5.8 | |
| Fedoraproject Sssd | =1.5.9 | |
| Fedoraproject Sssd | =1.5.10 | |
| Fedoraproject Sssd | =1.5.11 | |
| Fedoraproject Sssd | =1.5.12 | |
| Fedoraproject Sssd | =1.5.13 | |
| Fedoraproject Sssd | =1.5.14 | |
| Fedoraproject Sssd | =1.5.15 | |
| Fedoraproject Sssd | =1.5.16 | |
| Fedoraproject Sssd | =1.5.17 | |
| Fedoraproject Sssd | =1.6.0 | |
| Fedoraproject Sssd | =1.6.1 | |
| Fedoraproject Sssd | =1.6.2 | |
| Fedoraproject Sssd | =1.6.3 | |
| Fedoraproject Sssd | =1.6.4 | |
| Fedoraproject Sssd | =1.7.0 | |
| Fedoraproject Sssd | =1.8.0 | |
| Fedoraproject Sssd | =1.8.0-beta1 | |
| Fedoraproject Sssd | =1.8.0-beta2 | |
| Fedoraproject Sssd | =1.8.0-beta3 | |
| Fedoraproject Sssd | =1.8.1 | |
| Fedoraproject Sssd | =1.8.2 | |
| Fedoraproject Sssd | =1.8.3 | |
| Fedoraproject Sssd | =1.8.4 | |
| Fedoraproject Sssd | =1.8.5 | |
| Fedoraproject Sssd | =1.8.6 | |
| Fedoraproject Sssd | =1.9.0 | |
| Fedoraproject Sssd | =1.9.1 | |
| Fedoraproject Sssd | =1.9.2 | |
| Redhat Enterprise Linux | =5 | |
| Redhat Enterprise Linux | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2013-0219
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=903145
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=903146
- https://rhn.redhat.com/errata/RHSA-2013-0508.html
- https://rhn.redhat.com/errata/RHSA-2013-1319.html
- https://bugzilla.redhat.com/show_bug.cgi?id=884254
- http://git.fedorahosted.org/cgit/sssd.git/commit/?id=020bf88fd1c5bdac8fc671b37c7118f5378c7047
- http://git.fedorahosted.org/cgit/sssd.git/commit/?id=3843b284cd3e8f88327772ebebc7249990fd87b9
- http://git.fedorahosted.org/cgit/sssd.git/commit/?id=94cbf1cfb0f88c967f1fb0a4cf23723148868e4a
- http://git.fedorahosted.org/cgit/sssd.git/commit/?id=e864d914a44a37016736554e9257c06b18c57d37
- http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098434.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098613.html
- http://rhn.redhat.com/errata/RHSA-2013-0508.html
- http://rhn.redhat.com/errata/RHSA-2013-1319.html
- http://secunia.com/advisories/51928
- http://secunia.com/advisories/52315
- http://www.securityfocus.com/bid/57539
- https://fedorahosted.org/sssd/ticket/1782
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/tags
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-0219
- vendor/fedoraproject
- canonical/fedoraproject sssd
- version/fedoraproject sssd/1.9.3
- version/fedoraproject sssd/0.2.1
- version/fedoraproject sssd/0.3.0
- version/fedoraproject sssd/0.3.1
- version/fedoraproject sssd/0.3.2
- version/fedoraproject sssd/0.3.3
- version/fedoraproject sssd/0.4.0
- version/fedoraproject sssd/0.4.1
- version/fedoraproject sssd/0.5.0
- version/fedoraproject sssd/0.6.0
- version/fedoraproject sssd/0.6.1
- version/fedoraproject sssd/0.7.0
- version/fedoraproject sssd/0.7.1
- version/fedoraproject sssd/0.99.0
- version/fedoraproject sssd/0.99.1
- version/fedoraproject sssd/1.0.0
- version/fedoraproject sssd/1.0.1
- version/fedoraproject sssd/1.0.2
- version/fedoraproject sssd/1.0.3
- version/fedoraproject sssd/1.0.4
- version/fedoraproject sssd/1.0.5
- version/fedoraproject sssd/1.0.6
- version/fedoraproject sssd/1.0.99
- version/fedoraproject sssd/1.1.0
- version/fedoraproject sssd/1.1.1
- version/fedoraproject sssd/1.1.2
- version/fedoraproject sssd/1.1.91
- version/fedoraproject sssd/1.1.92
- version/fedoraproject sssd/1.2.0
- version/fedoraproject sssd/1.2.1
- version/fedoraproject sssd/1.2.2
- version/fedoraproject sssd/1.2.3
- version/fedoraproject sssd/1.2.4
- version/fedoraproject sssd/1.2.91
- version/fedoraproject sssd/1.3.0
- version/fedoraproject sssd/1.3.1
- version/fedoraproject sssd/1.4.0
- version/fedoraproject sssd/1.4.1
- version/fedoraproject sssd/1.5.0
- version/fedoraproject sssd/1.5.1
- version/fedoraproject sssd/1.5.2
- version/fedoraproject sssd/1.5.3
- version/fedoraproject sssd/1.5.4
- version/fedoraproject sssd/1.5.5
- version/fedoraproject sssd/1.5.6
- version/fedoraproject sssd/1.5.6.1
- version/fedoraproject sssd/1.5.7
- version/fedoraproject sssd/1.5.8
- version/fedoraproject sssd/1.5.9
- version/fedoraproject sssd/1.5.10
- version/fedoraproject sssd/1.5.11
- version/fedoraproject sssd/1.5.12
- version/fedoraproject sssd/1.5.13
- version/fedoraproject sssd/1.5.14
- version/fedoraproject sssd/1.5.15
- version/fedoraproject sssd/1.5.16
- version/fedoraproject sssd/1.5.17
- version/fedoraproject sssd/1.6.0
- version/fedoraproject sssd/1.6.1
- version/fedoraproject sssd/1.6.2
- version/fedoraproject sssd/1.6.3
- version/fedoraproject sssd/1.6.4
- version/fedoraproject sssd/1.7.0
- version/fedoraproject sssd/1.8.0
- version/fedoraproject sssd/1.8.0-beta1
- version/fedoraproject sssd/1.8.0-beta2
- version/fedoraproject sssd/1.8.0-beta3
- version/fedoraproject sssd/1.8.1
- version/fedoraproject sssd/1.8.2
- version/fedoraproject sssd/1.8.3
- version/fedoraproject sssd/1.8.4
- version/fedoraproject sssd/1.8.5
- version/fedoraproject sssd/1.8.6
- version/fedoraproject sssd/1.9.0
- version/fedoraproject sssd/1.9.1
- version/fedoraproject sssd/1.9.2
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/5
- version/redhat enterprise linux/6.0