CVE-2013-0220: Buffer Overflow
First published: Thu Dec 06 2012(Updated: )
Multiple out-of-buffer bounds read flaws were found in the way autofs and ssh service responders of sssd, a System Security Services Daemon, performed parsing of SSSD packet values. An attacker could provide a specially-crafted packet that, when processed by the autofs or ssh service responders of sssd would lead to sssd server crash (temporary denial of service). This issue was found by Florian Weimer of Red Hat Product Security Team.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fedora Hosted SSSD | <=1.9.3 | |
| Fedora Hosted SSSD | =0.2.1 | |
| Fedora Hosted SSSD | =0.3.0 | |
| Fedora Hosted SSSD | =0.3.1 | |
| Fedora Hosted SSSD | =0.3.2 | |
| Fedora Hosted SSSD | =0.3.3 | |
| Fedora Hosted SSSD | =0.4.0 | |
| Fedora Hosted SSSD | =0.4.1 | |
| Fedora Hosted SSSD | =0.5.0 | |
| Fedora Hosted SSSD | =0.6.0 | |
| Fedora Hosted SSSD | =0.6.1 | |
| Fedora Hosted SSSD | =0.7.0 | |
| Fedora Hosted SSSD | =0.7.1 | |
| Fedora Hosted SSSD | =0.99.0 | |
| Fedora Hosted SSSD | =0.99.1 | |
| Fedora Hosted SSSD | =1.0.0 | |
| Fedora Hosted SSSD | =1.0.1 | |
| Fedora Hosted SSSD | =1.0.2 | |
| Fedora Hosted SSSD | =1.0.3 | |
| Fedora Hosted SSSD | =1.0.4 | |
| Fedora Hosted SSSD | =1.0.5 | |
| Fedora Hosted SSSD | =1.0.6 | |
| Fedora Hosted SSSD | =1.0.99 | |
| Fedora Hosted SSSD | =1.1.0 | |
| Fedora Hosted SSSD | =1.1.1 | |
| Fedora Hosted SSSD | =1.1.2 | |
| Fedora Hosted SSSD | =1.1.91 | |
| Fedora Hosted SSSD | =1.1.92 | |
| Fedora Hosted SSSD | =1.2.0 | |
| Fedora Hosted SSSD | =1.2.1 | |
| Fedora Hosted SSSD | =1.2.2 | |
| Fedora Hosted SSSD | =1.2.3 | |
| Fedora Hosted SSSD | =1.2.4 | |
| Fedora Hosted SSSD | =1.2.91 | |
| Fedora Hosted SSSD | =1.3.0 | |
| Fedora Hosted SSSD | =1.3.1 | |
| Fedora Hosted SSSD | =1.4.0 | |
| Fedora Hosted SSSD | =1.4.1 | |
| Fedora Hosted SSSD | =1.5.0 | |
| Fedora Hosted SSSD | =1.5.1 | |
| Fedora Hosted SSSD | =1.5.2 | |
| Fedora Hosted SSSD | =1.5.3 | |
| Fedora Hosted SSSD | =1.5.4 | |
| Fedora Hosted SSSD | =1.5.5 | |
| Fedora Hosted SSSD | =1.5.6 | |
| Fedora Hosted SSSD | =1.5.6.1 | |
| Fedora Hosted SSSD | =1.5.7 | |
| Fedora Hosted SSSD | =1.5.8 | |
| Fedora Hosted SSSD | =1.5.9 | |
| Fedora Hosted SSSD | =1.5.10 | |
| Fedora Hosted SSSD | =1.5.11 | |
| Fedora Hosted SSSD | =1.5.12 | |
| Fedora Hosted SSSD | =1.5.13 | |
| Fedora Hosted SSSD | =1.5.14 | |
| Fedora Hosted SSSD | =1.5.15 | |
| Fedora Hosted SSSD | =1.5.16 | |
| Fedora Hosted SSSD | =1.5.17 | |
| Fedora Hosted SSSD | =1.6.0 | |
| Fedora Hosted SSSD | =1.6.1 | |
| Fedora Hosted SSSD | =1.6.2 | |
| Fedora Hosted SSSD | =1.6.3 | |
| Fedora Hosted SSSD | =1.6.4 | |
| Fedora Hosted SSSD | =1.7.0 | |
| Fedora Hosted SSSD | =1.8.0 | |
| Fedora Hosted SSSD | =1.8.0-beta1 | |
| Fedora Hosted SSSD | =1.8.0-beta2 | |
| Fedora Hosted SSSD | =1.8.0-beta3 | |
| Fedora Hosted SSSD | =1.8.1 | |
| Fedora Hosted SSSD | =1.8.2 | |
| Fedora Hosted SSSD | =1.8.3 | |
| Fedora Hosted SSSD | =1.8.4 | |
| Fedora Hosted SSSD | =1.8.5 | |
| Fedora Hosted SSSD | =1.8.6 | |
| Fedora Hosted SSSD | =1.9.0 | |
| Fedora Hosted SSSD | =1.9.1 | |
| Fedora Hosted SSSD | =1.9.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.fedorahosted.org/cgit/sssd.git/commit/?id=2bd514cfde1938b1e245af11c9b548d58d49b325
- http://git.fedorahosted.org/cgit/sssd.git/commit/?id=30e2585dd46b62aa3a4abdf6de3f40a20e1743ab
- http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098434.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098613.html
- http://rhn.redhat.com/errata/RHSA-2013-0508.html
- http://secunia.com/advisories/51928
- http://secunia.com/advisories/52315
- http://www.securityfocus.com/bid/57539
- https://bugzilla.redhat.com/show_bug.cgi?id=884601
- https://fedorahosted.org/sssd/ticket/1781
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=658700&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=658700&action=edit
- https://access.redhat.com/security/cve/CVE-2013-0220
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=903145
- https://rhn.redhat.com/errata/RHSA-2013-0508.html
Frequently Asked Questions
What is the severity of CVE-2013-0220?
CVE-2013-0220 is classified as a high-severity vulnerability due to multiple out-of-buffer bounds read flaws that could be exploited by attackers.
How can I fix CVE-2013-0220?
To fix CVE-2013-0220, update the System Security Services Daemon (sssd) to the latest version that is not affected by the vulnerability.
What versions are affected by CVE-2013-0220?
CVE-2013-0220 affects multiple versions of sssd, specifically versions up to and including 1.9.3 and several earlier versions.
What can an attacker do with CVE-2013-0220?
An attacker can exploit CVE-2013-0220 to craft a malicious packet that could lead to out-of-bounds read conditions in the autofs and ssh service responders.
Is there a patch available for CVE-2013-0220?
Yes, patches are available for CVE-2013-0220 to mitigate the vulnerabilities in affected versions of sssd.
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-0220
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/fedoraproject
- canonical/fedora hosted sssd
- version/fedora hosted sssd/1.9.3
- version/fedora hosted sssd/0.2.1
- version/fedora hosted sssd/0.3.0
- version/fedora hosted sssd/0.3.1
- version/fedora hosted sssd/0.3.2
- version/fedora hosted sssd/0.3.3
- version/fedora hosted sssd/0.4.0
- version/fedora hosted sssd/0.4.1
- version/fedora hosted sssd/0.5.0
- version/fedora hosted sssd/0.6.0
- version/fedora hosted sssd/0.6.1
- version/fedora hosted sssd/0.7.0
- version/fedora hosted sssd/0.7.1
- version/fedora hosted sssd/0.99.0
- version/fedora hosted sssd/0.99.1
- version/fedora hosted sssd/1.0.0
- version/fedora hosted sssd/1.0.1
- version/fedora hosted sssd/1.0.2
- version/fedora hosted sssd/1.0.3
- version/fedora hosted sssd/1.0.4
- version/fedora hosted sssd/1.0.5
- version/fedora hosted sssd/1.0.6
- version/fedora hosted sssd/1.0.99
- version/fedora hosted sssd/1.1.0
- version/fedora hosted sssd/1.1.1
- version/fedora hosted sssd/1.1.2
- version/fedora hosted sssd/1.1.91
- version/fedora hosted sssd/1.1.92
- version/fedora hosted sssd/1.2.0
- version/fedora hosted sssd/1.2.1
- version/fedora hosted sssd/1.2.2
- version/fedora hosted sssd/1.2.3
- version/fedora hosted sssd/1.2.4
- version/fedora hosted sssd/1.2.91
- version/fedora hosted sssd/1.3.0
- version/fedora hosted sssd/1.3.1
- version/fedora hosted sssd/1.4.0
- version/fedora hosted sssd/1.4.1
- version/fedora hosted sssd/1.5.0
- version/fedora hosted sssd/1.5.1
- version/fedora hosted sssd/1.5.2
- version/fedora hosted sssd/1.5.3
- version/fedora hosted sssd/1.5.4
- version/fedora hosted sssd/1.5.5
- version/fedora hosted sssd/1.5.6
- version/fedora hosted sssd/1.5.6.1
- version/fedora hosted sssd/1.5.7
- version/fedora hosted sssd/1.5.8
- version/fedora hosted sssd/1.5.9
- version/fedora hosted sssd/1.5.10
- version/fedora hosted sssd/1.5.11
- version/fedora hosted sssd/1.5.12
- version/fedora hosted sssd/1.5.13
- version/fedora hosted sssd/1.5.14
- version/fedora hosted sssd/1.5.15
- version/fedora hosted sssd/1.5.16
- version/fedora hosted sssd/1.5.17
- version/fedora hosted sssd/1.6.0
- version/fedora hosted sssd/1.6.1
- version/fedora hosted sssd/1.6.2
- version/fedora hosted sssd/1.6.3
- version/fedora hosted sssd/1.6.4
- version/fedora hosted sssd/1.7.0
- version/fedora hosted sssd/1.8.0
- version/fedora hosted sssd/1.8.0-beta1
- version/fedora hosted sssd/1.8.0-beta2
- version/fedora hosted sssd/1.8.0-beta3
- version/fedora hosted sssd/1.8.1
- version/fedora hosted sssd/1.8.2
- version/fedora hosted sssd/1.8.3
- version/fedora hosted sssd/1.8.4
- version/fedora hosted sssd/1.8.5
- version/fedora hosted sssd/1.8.6
- version/fedora hosted sssd/1.9.0
- version/fedora hosted sssd/1.9.1
- version/fedora hosted sssd/1.9.2