CVE-2013-0219: Race Condition
A TOCTOU (time-of-check time-of-use) race condition was found in the way SSSD, System Security Services Daemon, performed copying and removal of (user) directory trees.A local attacker, with permissions to write into directory of the victim, being actively / currently copied / removed via the sssd daemon facility, could use this flaw to conduct symbolic link attacks, leading to their ability to alter / remove directories outside of originally intended, to be modified, directory tree.
This issue was found by Florian Weimer of Red Hat Product Security Team.
Other sources
System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0219?
CVE-2013-0219 has been assigned a high severity rating due to its potential to allow local attackers unauthorized access to user directory trees.
How do I fix CVE-2013-0219?
To fix CVE-2013-0219, update to the latest version of SSSD that addresses this vulnerability.
What versions of SSSD are affected by CVE-2013-0219?
CVE-2013-0219 affects multiple versions of SSSD, primarily versions prior to 1.9.4.
Can I exploit CVE-2013-0219 remotely?
CVE-2013-0219 is a local vulnerability, meaning it cannot be exploited remotely as it requires local permissions.
What is a TOCTOU race condition in CVE-2013-0219?
A TOCTOU (Time of Check To Time of Use) race condition in CVE-2013-0219 occurs when an attacker modifies a user directory during a copy or removal process.