First published: Thu Dec 06 2012(Updated: )
Multiple out-of-buffer bounds read flaws were found in the way autofs and ssh service responders of sssd, a System Security Services Daemon, performed parsing of SSSD packet values. An attacker could provide a specially-crafted packet that, when processed by the autofs or ssh service responders of sssd would lead to sssd server crash (temporary denial of service). This issue was found by Florian Weimer of Red Hat Product Security Team.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
Fedora Hosted SSSD | <=1.9.3 | |
Fedora Hosted SSSD | =0.2.1 | |
Fedora Hosted SSSD | =0.3.0 | |
Fedora Hosted SSSD | =0.3.1 | |
Fedora Hosted SSSD | =0.3.2 | |
Fedora Hosted SSSD | =0.3.3 | |
Fedora Hosted SSSD | =0.4.0 | |
Fedora Hosted SSSD | =0.4.1 | |
Fedora Hosted SSSD | =0.5.0 | |
Fedora Hosted SSSD | =0.6.0 | |
Fedora Hosted SSSD | =0.6.1 | |
Fedora Hosted SSSD | =0.7.0 | |
Fedora Hosted SSSD | =0.7.1 | |
Fedora Hosted SSSD | =0.99.0 | |
Fedora Hosted SSSD | =0.99.1 | |
Fedora Hosted SSSD | =1.0.0 | |
Fedora Hosted SSSD | =1.0.1 | |
Fedora Hosted SSSD | =1.0.2 | |
Fedora Hosted SSSD | =1.0.3 | |
Fedora Hosted SSSD | =1.0.4 | |
Fedora Hosted SSSD | =1.0.5 | |
Fedora Hosted SSSD | =1.0.6 | |
Fedora Hosted SSSD | =1.0.99 | |
Fedora Hosted SSSD | =1.1.0 | |
Fedora Hosted SSSD | =1.1.1 | |
Fedora Hosted SSSD | =1.1.2 | |
Fedora Hosted SSSD | =1.1.91 | |
Fedora Hosted SSSD | =1.1.92 | |
Fedora Hosted SSSD | =1.2.0 | |
Fedora Hosted SSSD | =1.2.1 | |
Fedora Hosted SSSD | =1.2.2 | |
Fedora Hosted SSSD | =1.2.3 | |
Fedora Hosted SSSD | =1.2.4 | |
Fedora Hosted SSSD | =1.2.91 | |
Fedora Hosted SSSD | =1.3.0 | |
Fedora Hosted SSSD | =1.3.1 | |
Fedora Hosted SSSD | =1.4.0 | |
Fedora Hosted SSSD | =1.4.1 | |
Fedora Hosted SSSD | =1.5.0 | |
Fedora Hosted SSSD | =1.5.1 | |
Fedora Hosted SSSD | =1.5.2 | |
Fedora Hosted SSSD | =1.5.3 | |
Fedora Hosted SSSD | =1.5.4 | |
Fedora Hosted SSSD | =1.5.5 | |
Fedora Hosted SSSD | =1.5.6 | |
Fedora Hosted SSSD | =1.5.6.1 | |
Fedora Hosted SSSD | =1.5.7 | |
Fedora Hosted SSSD | =1.5.8 | |
Fedora Hosted SSSD | =1.5.9 | |
Fedora Hosted SSSD | =1.5.10 | |
Fedora Hosted SSSD | =1.5.11 | |
Fedora Hosted SSSD | =1.5.12 | |
Fedora Hosted SSSD | =1.5.13 | |
Fedora Hosted SSSD | =1.5.14 | |
Fedora Hosted SSSD | =1.5.15 | |
Fedora Hosted SSSD | =1.5.16 | |
Fedora Hosted SSSD | =1.5.17 | |
Fedora Hosted SSSD | =1.6.0 | |
Fedora Hosted SSSD | =1.6.1 | |
Fedora Hosted SSSD | =1.6.2 | |
Fedora Hosted SSSD | =1.6.3 | |
Fedora Hosted SSSD | =1.6.4 | |
Fedora Hosted SSSD | =1.7.0 | |
Fedora Hosted SSSD | =1.8.0 | |
Fedora Hosted SSSD | =1.8.0-beta1 | |
Fedora Hosted SSSD | =1.8.0-beta2 | |
Fedora Hosted SSSD | =1.8.0-beta3 | |
Fedora Hosted SSSD | =1.8.1 | |
Fedora Hosted SSSD | =1.8.2 | |
Fedora Hosted SSSD | =1.8.3 | |
Fedora Hosted SSSD | =1.8.4 | |
Fedora Hosted SSSD | =1.8.5 | |
Fedora Hosted SSSD | =1.8.6 | |
Fedora Hosted SSSD | =1.9.0 | |
Fedora Hosted SSSD | =1.9.1 | |
Fedora Hosted SSSD | =1.9.2 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2013-0220 is classified as a high-severity vulnerability due to multiple out-of-buffer bounds read flaws that could be exploited by attackers.
To fix CVE-2013-0220, update the System Security Services Daemon (sssd) to the latest version that is not affected by the vulnerability.
CVE-2013-0220 affects multiple versions of sssd, specifically versions up to and including 1.9.3 and several earlier versions.
An attacker can exploit CVE-2013-0220 to craft a malicious packet that could lead to out-of-bounds read conditions in the autofs and ssh service responders.
Yes, patches are available for CVE-2013-0220 to mitigate the vulnerabilities in affected versions of sssd.