CVE-2013-0287
First published: Thu Mar 21 2013(Updated: )
The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fedora Hosted SSSD | =1.9.0 | |
| Fedora Hosted SSSD | =1.9.1 | |
| Fedora Hosted SSSD | =1.9.2 | |
| Fedora Hosted SSSD | =1.9.3 | |
| Fedora Hosted SSSD | =1.9.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=910938
- http://git.fedorahosted.org/cgit/sssd.git/patch/?id=26590d31f492dbbd36be6d0bde46a4bd3b221edb
- http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6569d57e3bc168e6e83d70333b48c5cb43aa04c4
- http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6837eee3f7f81c0ee454d3718d67d7f3cc6b48ef
- http://git.fedorahosted.org/cgit/sssd.git/patch/?id=754b09b5444e6da88ed58d6deaed8b815e268b6b
- http://git.fedorahosted.org/cgit/sssd.git/patch/?id=7619be9f6bf649665fcbeee9e6b120f9f9cba2a5
- http://git.fedorahosted.org/cgit/sssd.git/patch/?id=8b8019fe3dd1564fba657e219ec20ff816c7ffdb
- http://git.fedorahosted.org/cgit/sssd.git/patch/?id=b63830b142053f99bfe954d4be5a2b0f68ce3a93
- http://git.fedorahosted.org/cgit/sssd.git/patch/?id=c0bca1722d6f9dfb654ad78397be70f79ff39af1
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00115.html
- http://rhn.redhat.com/errata/RHSA-2013-0663.html
- http://secunia.com/advisories/52704
- http://secunia.com/advisories/52722
- http://securitytracker.com/id?1028317
- http://www.securityfocus.com/bid/58593
- https://lists.fedorahosted.org/pipermail/sssd-devel/2013-March/014066.html
Frequently Asked Questions
What is the severity of CVE-2013-0287?
CVE-2013-0287 has a medium severity rating due to the potential for unauthorized access by remote authenticated users.
How do I fix CVE-2013-0287?
To fix CVE-2013-0287, upgrade to SSSD version 1.9.5 or later where the simple_deny_groups option is properly enforced.
What software is affected by CVE-2013-0287?
CVE-2013-0287 affects SSSD versions 1.9.0 through 1.9.4.
What type of vulnerability is CVE-2013-0287?
CVE-2013-0287 is a security vulnerability in the Simple Access Provider of the System Security Services Daemon.
Can CVE-2013-0287 be exploited remotely?
Yes, CVE-2013-0287 can be exploited remotely by authenticated users to bypass access restrictions.
- agent/references
- agent/softwarecombine
- agent/remedy
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/fedoraproject
- canonical/fedora hosted sssd
- version/fedora hosted sssd/1.9.0
- version/fedora hosted sssd/1.9.1
- version/fedora hosted sssd/1.9.2
- version/fedora hosted sssd/1.9.3
- version/fedora hosted sssd/1.9.4