CVE-2013-0220: Buffer Overflow
Multiple out-of-buffer bounds read flaws were found in the way autofs and ssh service responders of sssd, a System Security Services Daemon, performed parsing of SSSD packet values. An attacker could provide a specially-crafted packet that, when processed by the autofs or ssh service responders of sssd would lead to sssd server crash (temporary denial of service).
This issue was found by Florian Weimer of Red Hat Product Security Team.
Other sources
The (1) sssautofscmdgetautomntent and (2) sssautofscmdgetautomntbyname function in responder/autofs/autofssrvcmd.c and the (3) sshcmdparserequest function in responder/ssh/sshsrvcmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0220?
CVE-2013-0220 is classified as a high-severity vulnerability due to multiple out-of-buffer bounds read flaws that could be exploited by attackers.
How can I fix CVE-2013-0220?
To fix CVE-2013-0220, update the System Security Services Daemon (sssd) to the latest version that is not affected by the vulnerability.
What versions are affected by CVE-2013-0220?
CVE-2013-0220 affects multiple versions of sssd, specifically versions up to and including 1.9.3 and several earlier versions.
What can an attacker do with CVE-2013-0220?
An attacker can exploit CVE-2013-0220 to craft a malicious packet that could lead to out-of-bounds read conditions in the autofs and ssh service responders.
Is there a patch available for CVE-2013-0220?
Yes, patches are available for CVE-2013-0220 to mitigate the vulnerabilities in affected versions of sssd.