SSSD Multiple Denial of Service Vulnerabilities

Bugtraq ID:	57539
Class:	Design Error
CVE:	CVE-2013-0219 CVE-2013-0220
Remote:	No
Local:	Yes
Published:	Jan 24 2013 12:00AM
Updated:	Apr 16 2015 06:13PM
Credit:	Florian Weimer
Vulnerable:	Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Oracle Enterprise Linux 5 CentOS CentOS 6
Not Vulnerable:

SSSD Multiple Denial of Service Vulnerabilities

SSSD is prone to multiple local denial-of-service vulnerabilities.

Attackers can exploit these issues to cause the application to crash, denying service to legitimate users.

SSSD 1.9.3 is vulnerable; other versions may also be affected.

SSSD Multiple Denial of Service Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SSSD Multiple Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

SSSD Multiple Denial of Service Vulnerabilities

References:

• Product Homepage (RedHat)
  
• sssd: Out-of-bounds read flaws in autofs and ssh services responders (edgewall software)
  
• TOCTOU race conditions by copying and removing directory trees (edgewall software)