CVE-2017-12173: Input Validation
It was found that sssd's sysdbsearchuserbyupnres() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.
Other sources
SSSD stores its cached data in an LDAP like local database file using libldb. To lookup cached data LDAP search filters like '(objectClass=user)(name=username)' are used. However, in sysdbsearchuserbyupnres(), the input is not sanitized and allows to manipulate the search filter for cache lookups.
This would allow a logged in user to discover the password hash of a different user. The password hash would be cached after a successful authentication of the corresponding user.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12173?
CVE-2017-12173 is considered a high severity vulnerability due to its potential for injection attacks.
How do I fix CVE-2017-12173?
To fix CVE-2017-12173, upgrade the sssd package to version 1.16.0 or later.
Which systems are affected by CVE-2017-12173?
CVE-2017-12173 affects Red Hat Enterprise Linux desktop and server versions 6.0 and 7.0, among other derivatives.
Can CVE-2017-12173 be exploited by an unauthenticated user?
No, CVE-2017-12173 requires an authenticated attacker to exploit the vulnerability.
What is the main cause of CVE-2017-12173?
CVE-2017-12173 is caused by inadequate sanitization of requests in the sysdb_search_user_by_upn_res() function.