REDHAT-BUG-2496581: Medium severity SSSD AD GPO provider vulnerability
The adgpoextractsmbcomponents() function in SSSD's AD GPO provider converts backslashes to forward slashes in the gPCFileSysPath LDAP attribute but does not sanitize .. path components. A differential between libsmbclient's path clamping (resolves .. at the share root) and the kernel's path resolution (resolves .. fully) allows an attacker with AD GPO management access to write files outside the GPO cache directory as root.
On SELinux-enforcing systems (the default on RHEL), the traversal can target /var/lib/sss/pubconf/krb5.include.d/ (labeled sssdpublict), enabling Kerberos KDC redirection and authentication bypass. On SELinux-permissive or disabled systems, arbitrary file write as root is possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2496581?
The severity of REDHAT-BUG-2496581 is rated as medium, with a score of 4.
How do I fix REDHAT-BUG-2496581?
To fix REDHAT-BUG-2496581, you should update the SSSD package to the latest available version that addresses the vulnerability.
What vulnerabilities are associated with REDHAT-BUG-2496581?
REDHAT-BUG-2496581 is associated with the improper sanitization of directory traversal components in the ad_gpo_extract_smb_components() function.
Is REDHAT-BUG-2496581 easy to exploit?
Exploitation of REDHAT-BUG-2496581 may require specific conditions related to LDAP attributes and directory paths, indicating a moderate difficulty level.
What impact does REDHAT-BUG-2496581 have on systems?
REDHAT-BUG-2496581 could allow unauthorized access to files outside of intended directories through directory traversal attacks.