Ted Brunell reported that SSSD, when authenticating against an LDAP server that allows unauthenticated binds, would authenticate users providing an empty password to any service using pamauthenticate (such as the GNOME screensaver). This could allow a local or remote attacker to gain access to an account without knowing the victim's password.

This flaw can only be exploited if the directory server allows unauthenticated binds, because the directory server will return that the bind was successful if no password is provided.

Acknowledgements:

Red Hat would like to thank Ted Brunell for reporting this issue.