Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2015-829:03 advisory.

    Provides a set of daemons to manage access to remote directories and     authentication mechanisms. It provides an NSS and PAM interface toward     the system and a pluggable backend system to connect to multiple different     account sources. It is also the basis to provide client auditing and policy     services for projects like FreeIPA.
    The sssd subpackage is a meta-package that contains the deamon as well as all     the existing back ends.
    Security issues fixed with this release:
    CVE-2015-5292     Memory leak in the Privilege Attribute Certificate (PAC) responder     plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD)     1.10 before 1.13.1 allows remote authenticated users to cause a denial     of service (memory consumption) via a large number of logins that     trigger parsing of PAC blobs during Kerberos authentication.
    Enhancements:
    * SSSD smart card support     Fixed bugs:
    * When the SELinux user content on an IdM server was set to an empty string, the SSSD SELinux evaluation     utility returned an error.
    * If the ldap_child process failed to initialize credentials and exited with an error multiple times,     operations that create files in some cases started failing due to an insufficient amount of i-nodes.
    * The SRV queries used a hard coded TTL timeout, and environments that wanted the SRV queries to be valid     for a certain time only were blocked. Now, SSSD parses the TTL value out of the DNS packet.
    * Previously, initgroups operation took an excessive amount of time. Now, logins and ID processing are     faster for setups with AD back end and disabled ID mapping.
    * When an IdM client with Red Hat Enterprise Linux 7.1 or later was connecting to a server with Red Hat     Enterprise Linux 7.0 or earlier, authentication with an AD trusted domain caused the sssd_be process to     terminate unexpectedly.
    * If replication conflict entries appeared during HBAC processing, the user was denied access. Now, the     replication conflict entries are skipped and users are permitted access.
    * The array of SIDs no longer contains an uninitialized value and SSSD no longer crashes.
    * SSSD supports GPOs from different domain controllers and no longer crashes when processing GPOs from     different domain controllers.
    * SSSD could not refresh sudo rules that contained groups with special characters, such as parentheses, in     their name.
    * The IPA names are not qualified on the client side if the server already qualified them, and IdM group     members resolve even if default_domain_suffix is used on the server side.
    * The internal cache cleanup task has been disabled by default to improve performance of the sssd_be     process.
    * Now, default_domain_suffix is not considered anymore for autofs maps.
    * The user can set subdomain_inherit=ignore_group-members to disable fetching group members for trusted     domains.
    * The group resolution failed with an error message: Error: 14 (Bad address). The binary GUID handling     has been fixed.
    Enhancements:
    * The description of default_domain_suffix has been improved in the manual pages.
    * With the new %0 template option, users on SSSD IdM clients can now use home directories set on AD.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2015-557:03 advisory.

    Provides a set of daemons to manage access to remote directories and     authentication mechanisms. It provides an NSS and PAM interface toward     the system and a pluggable backend system to connect to multiple different     account sources. It is also the basis to provide client auditing and policy     services for projects like FreeIPA.
    Security issues fixed with this release:
    CVE-2015-5292     Memory leak in the Privilege Attribute Certificate (PAC) responder     plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD)     1.10 before 1.13.1 allows remote authenticated users to cause a denial     of service (memory consumption) via a large number of logins that     trigger parsing of PAC blobs during Kerberos authentication.
    Fixed bugs:
    * Previously, SSSD did not correctly handle sudo rules that applied to groups with names containing     special characters, such as the ( opening parenthesis sign. Consequently, SSSD skipped such sudo rules.
    The internal sysdb search has been modified to escape special characters when searching for objects to     which sudo rules apply. As a result, SSSD applies the described sudo rules as expected.
    * Prior to this update, SSSD did not correctly handle group names containing special Lightweight Directory     Access Protocol (LDAP) characters, such as the ( or ) parenthesis signs. When a group name contained     one or more such characters, the internal cache cleanup operation failed with an I/O error. With this     update, LDAP special characters in the Distinguished Name (DN) of a cache entry are escaped before the     cleanup operation starts. As a result, the cleanup operation completes successfully in the described     situation.
    * Applications performing Kerberos authentication previously increased the memory footprint of the     Kerberos plug-in that parses the Privilege Attribute Certificate (PAC) information. The plug-in has been     updated to free the memory it allocates, thus fixing this bug.
    * Previously, when malformed POSIX attributes were defined in an Active Directory (AD) LDAP server, SSSD     unexpectedly switched to offline mode. This update relaxes certain checks for AD POSIX attribute validity.
    As a result, SSSD now works as expected even when malformed POSIX attributes are present in AD and no     longer enters offline mode in the described situation.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System     Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of     service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during     Kerberos authentication. (CVE-2015-5292)

Note that Nessus relies on the presence of the package as reported by the vendor.

Security fix for CVE-2015-5292

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that SSSD's Privilege Attribute Certificate (PAC) responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in.

It was found that SSSD's Privilege Attribute Certificate (PAC) responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in. (CVE-2015-5292)

The sssd packages have been upgraded to upstream version 1.13.0, which provides a number of bug fixes and enhancements over the previous version.

  - SSSD smart card support * Cache authentication in SSSD *     SSSD supports overriding automatically discovered AD     site * SSSD can now deny SSH access to locked accounts *     SSSD enables UID and GID mapping on individual clients *     Background refresh of cached entries * Multi-step     prompting for one-time and long-term passwords * Caching     for initgroups operations

Bugs fixed :

  - When the SELinux user content on an IdM server was set     to an empty string, the SSSD SELinux evaluation utility     returned an error.

  - If the ldap_child process failed to initialize     credentials and exited with an error multiple times,     operations that create files in some cases started     failing due to an insufficient amount of i-nodes.

  - The SRV queries used a hard-coded TTL timeout, and     environments that wanted the SRV queries to be valid for     a certain time only were blocked. Now, SSSD parses the     TTL value out of the DNS packet.

  - Previously, initgroups operation took an excessive     amount of time. Now, logins and ID processing are faster     for setups with AD back end and disabled ID mapping.

  - When an IdM client with Scientific Linux 7.1 or later     was connecting to a server with Scientific Linux 7.0 or     earlier, authentication with an AD trusted domain caused     the sssd_be process to terminate unexpectedly.

  - If replication conflict entries appeared during HBAC     processing, the user was denied access. Now, the     replication conflict entries are skipped and users are     permitted access.

  - The array of SIDs no longer contains an uninitialized     value and SSSD no longer crashes.

  - SSSD supports GPOs from different domain controllers and     no longer crashes when processing GPOs from different     domain controllers.

  - SSSD could not refresh sudo rules that contained groups     with special characters, such as parentheses, in their     name.

  - The IPA names are not qualified on the client side if     the server already qualified them, and IdM group members     resolve even if default_domain_suffix is used on the     server side.

  - The internal cache cleanup task has been disabled by     default to improve performance of the sssd_be process.

  - Now, default_domain_suffix is not considered anymore for     autofs maps.

  - The user can set subdomain_inherit=ignore_group-members     to disable fetching group members for trusted domains.

  - The group resolution failed with an error message:
    'Error: 14 (Bad address)'. The binary GUID handling has     been fixed.

Enhancements added :

  - The description of default_domain_suffix has been     improved in the manual pages.

  - With the new '%0' template option, users on SSSD IdM     clients can now use home directories set on AD.

Updated sssd packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms.

It was found that SSSD's Privilege Attribute Certificate (PAC) responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in. (CVE-2015-5292)

The sssd packages have been upgraded to upstream version 1.13.0, which provides a number of bug fixes and enhancements over the previous version. (BZ#1205554)

Several enhancements are described in the Red Hat Enterprise Linux 7.2 Release Notes, linked to in the References section :

* SSSD smart card support (BZ#854396)

* Cache authentication in SSSD (BZ#910187)

* SSSD supports overriding automatically discovered AD site (BZ#1163806)

* SSSD can now deny SSH access to locked accounts (BZ#1175760)

* SSSD enables UID and GID mapping on individual clients (BZ#1183747)

* Background refresh of cached entries (BZ#1199533)

* Multi-step prompting for one-time and long-term passwords (BZ#1200873)

* Caching for initgroups operations (BZ#1206575)

Bugs fixed :

* When the SELinux user content on an IdM server was set to an empty string, the SSSD SELinux evaluation utility returned an error.
(BZ#1192314)

* If the ldap_child process failed to initialize credentials and exited with an error multiple times, operations that create files in some cases started failing due to an insufficient amount of i-nodes.
(BZ#1198477)

* The SRV queries used a hard-coded TTL timeout, and environments that wanted the SRV queries to be valid for a certain time only were blocked. Now, SSSD parses the TTL value out of the DNS packet.
(BZ#1199541)

* Previously, initgroups operation took an excessive amount of time.
Now, logins and ID processing are faster for setups with AD back end and disabled ID mapping. (BZ#1201840)

* When an IdM client with Red Hat Enterprise Linux 7.1 or later was connecting to a server with Red Hat Enterprise Linux 7.0 or earlier, authentication with an AD trusted domain caused the sssd_be process to terminate unexpectedly. (BZ#1202170)

* If replication conflict entries appeared during HBAC processing, the user was denied access. Now, the replication conflict entries are skipped and users are permitted access. (BZ#1202245)

* The array of SIDs no longer contains an uninitialized value and SSSD no longer crashes. (BZ#1204203)

* SSSD supports GPOs from different domain controllers and no longer crashes when processing GPOs from different domain controllers.
(BZ#1205852)

* SSSD could not refresh sudo rules that contained groups with special characters, such as parentheses, in their name. (BZ#1208507)

* The IPA names are not qualified on the client side if the server already qualified them, and IdM group members resolve even if default_domain_suffix is used on the server side. (BZ#1211830)

* The internal cache cleanup task has been disabled by default to improve performance of the sssd_be process. (BZ#1212489)

* Now, default_domain_suffix is not considered anymore for autofs maps. (BZ#1216285)

* The user can set subdomain_inherit=ignore_group-members to disable fetching group members for trusted domains. (BZ#1217350)

* The group resolution failed with an error message: 'Error: 14 (Bad address)'. The binary GUID handling has been fixed. (BZ#1226119)

Enhancements added :

* The description of default_domain_suffix has been improved in the manual pages. (BZ#1185536)

* With the new '%0' template option, users on SSSD IdM clients can now use home directories set on AD. (BZ#1187103)

All sssd users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2355 advisory.

    [1.13.0-40]
    - Resolves: rhbz#1270827 - local overrides: don't contact server with                                overridden name/id

    [1.13.0-39]
    - Resolves: rhbz#1267837 - sssd_be crashed in ipa_srv_ad_acct_lookup_step

    [1.13.0-38]
    - Resolves: rhbz#1267176 - Memory leak / possible DoS with krb auth.

    [1.13.0-37]
    - Resolves: rhbz#1267836 - PAM responder crashed if user was not set

    [1.13.0-36]
    - Resolves: rhbz#1266107 - AD: Conditional jump or move depends on                                uninitialised value

    [1.13.0-35]
    - Resolves: rhbz#1250135 - Detect re-established trusts in the IPA                                subdomain code

    [1.13.0-34]
    - Fix a Coverity warning in dyndns code
    - Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead                                of processing other commands

    [1.13.0-33]
    - Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead                                of processing other commands

    [1.13.0-32]
    - Resolves: rhbz#1263735 - Could not resolve AD user from root domain

    [1.13.0-31]
    - Remove -d from sss_override manpage
    - Related: rhbz#1259512 - sss_override : The local override user is not found

    [1.13.0-30]
    - Patches required for better handling of failover with one-way trusts
    - Related: rhbz#1250135 - Detect re-established trusts in the IPA subdomain                               code

    [1.13.0-29]
    - Resolves: rhbz#1263587 - sss_override --name doesn't work with RFC2307                                and ghost users

    [1.13.0-28]
    - Resolves: rhbz#1259512 - sss_override : The local override user is not found

    [1.13.0-27]
    - Resolves: rhbz#1260027 - sssd_be memory leak with sssd-ad in GPO code

    [1.13.0-26]
    - Resolves: rhbz#1256398 - sssd cannot resolve user names containing                                backslash with ldap provider

    [1.13.0-25]
    - Resolves: rhbz#1254189 - sss_override contains an extra parameter --debug                                but is not listed in the man page or in                                the arguments help

    [1.13.0-24]
    - Resolves: rhbz#1254518 - Fix crash in nss responder

    [1.13.0-23]
    - Support import/export for local overrides
    - Support FQDNs for local overrides
    - Resolves: rhbz#1254184 - sss_override does not work correctly when                                'use_fully_qualified_names = True'

    [1.13.0-22]
    - Resolves: rhbz#1244950 - Add index for 'objectSIDString' and maybe to                                other cache attributes

    [1.13.0-21]
    - Resolves: rhbz#1250415 - sssd: p11_child hardening

    [1.13.0-20]
    - Related: rhbz#1250135 - Detect re-established trusts in the IPA                               subdomain code

    [1.13.0-19]
    - Resolves: rhbz#1202724 - [RFE] Add a way to lookup users based on CAC                                identity certificates

    [1.13.0-18]
    - Resolves: rhbz#1232950 - [IPA/IdM] sudoOrder not honored as expected

    [1.13.0-17]
    - Fix wildcard_limit=0
    - Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface

    [1.13.0-16]
    - Fix race condition in invalidating the memory cache
    - Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups

    [1.13.0-15]
    - Resolves: rhbz#1249015 - KDC proxy not working with SSSD krb5_use_kdcinfo                                enabled

    [1.13.0-14]
    - Bump release number
    - Related: rhbz#1246489 - sss_obfuscate fails with 'ImportError: No module                               named pysss'

    [1.13.0-13]
    - Fix missing dependency of sssd-tools
    - Resolves: rhbz#1246489 - sss_obfuscate fails with 'ImportError: No module                                named pysss'

    [1.13.0-12]
    - More memory cache related fixes
    - Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups

    [1.13.0-11]
    - Remove binary blob from SC patches as patch(1) can't handle those
    - Related: rhbz#854396 - [RFE] Support for smart cards

    [1.13.0-10]
    - Resolves: rhbz#1244949 - getgrgid for user's UID on a trust client                                prevents getpw*

    [1.13.0-9]
    - Fix memory cache integration tests
    - Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
    - Resolves: rhbz#854396 - [RFE] Support for smart cards

    [1.13.0-8]
    - Remove OTP from PAM stack correctly
    - Related: rhbz#1200873 - [RFE] Allow smart multi step prompting when                               user logs in with password and token code from IPA
    - Handle sssd-owned keytabs when sssd runs as root
    - Related: rhbz#1205144 - RFE: Support one-way trusts for IPA

    [1.13.0-7]
    - Resolves: rhbz#1183747 - [FEAT] UID and GID mapping on individual clients

    [1.13.0-6]
    - Resolves: rhbz#1206565 - [RFE] Add dualstack and multihomed support
    - Resolves: rhbz#1187146 - If v4 address exists, will not create nonexistant                                v6 in ipa domain

    [1.13.0-5]
    - Resolves: rhbz#1242942 - well-known SID check is broken for NetBIOS prefixes

    [1.13.0-4]
    - Resolves: rhbz#1234722 - sssd ad provider fails to start in rhel7.2

    [1.13.0-3]
    - Add support for InfoPipe wildcard requests
    - Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface

    [1.13.0-2]
    - Also package the initgr memcache
    - Related: rhbz#1205554 - Rebase SSSD to 1.13.x

    [1.13.0-1]
    - Rebase to 1.13.0 upstream
    - Related: rhbz#1205554 - Rebase SSSD to 1.13.x
    - Resolves: rhbz#910187 - [RFE] authenticate against cache in SSSD
    - Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups

    [1.13.0.3alpha]
    - Don't default to SSSD user
    - Related: rhbz#1205554 - Rebase SSSD to 1.13.x

    [1.13.0.2alpha]
    - Related: rhbz#1205554 - Rebase SSSD to 1.13.x
    - GPO default should be permissve

    [1.13.0.1alpha]
    - Resolves: rhbz#1205554 - Rebase SSSD to 1.13.x
    - Relax the libldb requirement
    - Resolves: rhbz#1221992 - sssd_be segfault at 0 ip sp error 6 in                                libtevent.so.0.9.21
    - Resolves: rhbz#1221839 - SSSD group enumeration inconsistent due to                                binary SIDs
    - Resolves: rhbz#1219285 - Unable to resolve group memberships for AD                                users when using sssd-1.12.2-58.el7_1.6.x86_64                                client in combination with                                ipa-server-3.0.0-42.el6.x86_64 with AD Trust
    - Resolves: rhbz#1217559 - [RFE] Support GPOs from different domain controllers
    - Resolves: rhbz#1217350 - ignore_group_members doesn't work for subdomains
    - Resolves: rhbz#1217127 - Override for IPA users with login does not list                                user all groups
    - Resolves: rhbz#1216285 - autofs provider fails when default_domain_suffix                                and use_fully_qualified_names set
    - Resolves: rhbz#1214719 - Group resolution is inconsistent with group                                overrides
    - Resolves: rhbz#1214718 - Overridde with --login fails trusted adusers                                group membership resolution
    - Resolves: rhbz#1214716 - idoverridegroup for ipa group with --group-name                                does not work
    - Resolves: rhbz#1214337 - Overrides with --login work in second attempt
    - Resolves: rhbz#1212489 - Disable the cleanup task by default
    - Resolves: rhbz#1211830 - external users do not resolve with                                'default_domain_suffix' set in IPA server sssd.conf
    - Resolves: rhbz#1210854 - Only set the selinux context if the context                                differs from the local one
    - Resolves: rhbz#1209483 - When using id_provider=proxy with                                auth_provider=ldap, it does not work as expected
    - Resolves: rhbz#1209374 - Man sssd-ad(5) lists Group Policy Management                                Editor naming for some policies but not for all
    - Resolves: rhbz#1208507 - sysdb sudo search doesn't escape special characters
    - Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface
    - Resolves: rhbz#1206566 - SSSD does not update Dynamic DNS records if                                the IPA domain differs from machine hostname's                                domain
    - Resolves: rhbz#1206189 - [bug] sssd always appends default_domain_suffix                                when checking for host keys
    - Resolves: rhbz#1204203 - sssd crashes intermittently
    - Resolves: rhbz#1203945 - [FJ7.0 Bug]: getgrent returns error because                                sss is written in nsswitch.conf as default
    - Resolves: rhbz#1203642 - GPO access control looks for computer object                                in user's domain only
    - Resolves: rhbz#1202245 - SSSD's HBAC processing is not permissive enough                                with broken replication entries
    - Resolves: rhbz#1201271 - sssd_nss segfaults if initgroups request is by                                UPN and doesn't find anything
    - Resolves: rhbz#1200873 - [RFE] Allow smart multi step prompting when                                user logs in with password and token code from IPA
    - Resolves: rhbz#1199541 - Read and use the TTL value when resolving a                                SRV query
    - Resolves: rhbz#1199533 - [RFE] Implement background refresh for users,                                groups or other cache objects
    - Resolves: rhbz#1199445 - Does sssd-ad use the most suitable attribute                                for group name?
    - Resolves: rhbz#1198477 - ccname_file_dummy is not unlinked on error
    - Resolves: rhbz#1187103 - [RFE] User's home directories are not taken                                from AD when there is an IPA trust with AD
    - Resolves: rhbz#1185536 - In ipa-ad trust, with 'default_domain_suffix' set                                to AD domain, IPA user are not able to log unless                                use_fully_qualified_names is set
    - Resolves: rhbz#1175760 - [RFE] Have OpenLDAP lock out ssh keys when                                account naturally expires
    - Resolves: rhbz#1163806 - [RFE]ad provider dns_discovery_domain option:
                               kerberos discovery is not using this option
    - Resolves: rhbz#1205160 - Complain loudly if backend doesn't start due                                to missing or invalid keytab

    [1.12.2-61]
    - Resolves: rhbz#1226119 - Properly handle AD's binary objectGUID

    [1.12.2-60]
    - Filter out domain-local groups during AD initgroups operation
    - Related: rhbz#1201840 - SSSD downloads too much information when fetching                               information about groups

    [1.12.2-59]
    - Resolves: rhbz#1201840 - SSSD downloads too much information when fetching                                information about groups

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:2355 advisory.

    The System Security Services Daemon (SSSD) service provides a set of     daemons to manage access to remote directories and authentication     mechanisms.

    It was found that SSSD's Privilege Attribute Certificate (PAC) responder     plug-in would leak a small amount of memory on each authentication request.
    A remote attacker could potentially use this flaw to exhaust all available     memory on the system by making repeated requests to a Kerberized daemon     application configured to authenticate using the PAC responder plug-in.
    (CVE-2015-5292)

    The sssd packages have been upgraded to upstream version 1.13.0, which     provides a number of bug fixes and enhancements over the previous version.
    (BZ#1205554)

    Several enhancements are described in the Red Hat Enterprise Linux 7.2     Release Notes, linked to in the References section:

    * SSSD smart card support (BZ#854396)
    * Cache authentication in SSSD (BZ#910187)
    * SSSD supports overriding automatically discovered AD site (BZ#1163806)
    * SSSD can now deny SSH access to locked accounts (BZ#1175760)
    * SSSD enables UID and GID mapping on individual clients (BZ#1183747)
    * Background refresh of cached entries (BZ#1199533)
    * Multi-step prompting for one-time and long-term passwords (BZ#1200873)
    * Caching for initgroups operations (BZ#1206575)

    Bugs fixed:

    * When the SELinux user content on an IdM server was set to an empty     string, the SSSD SELinux evaluation utility returned an error. (BZ#1192314)

    * If the ldap_child process failed to initialize credentials and exited     with an error multiple times, operations that create files in some cases     started failing due to an insufficient amount of i-nodes. (BZ#1198477)

    * The SRV queries used a hard coded TTL timeout, and environments that     wanted the SRV queries to be valid for a certain time only were blocked.
    Now, SSSD parses the TTL value out of the DNS packet. (BZ#1199541)

    * Previously, initgroups operation took an excessive amount of time. Now,     logins and ID processing are faster for setups with AD back end and     disabled ID mapping. (BZ#1201840)

    * When an IdM client with Red Hat Enterprise Linux 7.1 or later was     connecting to a server with Red Hat Enterprise Linux 7.0 or earlier,     authentication with an AD trusted domain caused the sssd_be process to     terminate unexpectedly. (BZ#1202170)

    * If replication conflict entries appeared during HBAC processing, the user     was denied access. Now, the replication conflict entries are skipped and     users are permitted access. (BZ#1202245)

    * The array of SIDs no longer contains an uninitialized value and SSSD no     longer crashes. (BZ#1204203)

    * SSSD supports GPOs from different domain controllers and no longer     crashes when processing GPOs from different domain controllers.
    (BZ#1205852)

    * SSSD could not refresh sudo rules that contained groups with special     characters, such as parentheses, in their name. (BZ#1208507)

    * The IPA names are not qualified on the client side if the server already     qualified them, and IdM group members resolve even if default_domain_suffix     is used on the server side. (BZ#1211830)

    * The internal cache cleanup task has been disabled by default to improve     performance of the sssd_be process. (BZ#1212489)

    * Now, default_domain_suffix is not considered anymore for autofs maps.
    (BZ#1216285)

    * The user can set subdomain_inherit=ignore_group-members to disable     fetching group members for trusted domains. (BZ#1217350)

    * The group resolution failed with an error message: Error: 14 (Bad     address). The binary GUID handling has been fixed. (BZ#1226119)

    Enhancements added:

    * The description of default_domain_suffix has been improved in the manual     pages. (BZ#1185536)

    * With the new %0 template option, users on SSSD IdM clients can now use     home directories set on AD. (BZ#1187103)

    All sssd users are advised to upgrade to these updated packages, which     correct these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was found that SSSD's Privilege Attribute Certificate (PAC) responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in. (CVE-2015-5292)

This update also fixes the following bugs :

  - Previously, SSSD did not correctly handle sudo rules     that applied to groups with names containing special     characters, such as the '(' opening parenthesis sign.
    Consequently, SSSD skipped such sudo rules. The internal     sysdb search has been modified to escape special     characters when searching for objects to which sudo     rules apply. As a result, SSSD applies the described     sudo rules as expected.

  - Prior to this update, SSSD did not correctly handle     group names containing special Lightweight Directory     Access Protocol (LDAP) characters, such as the '(' or     ')' parenthesis signs. When a group name contained one     or more such characters, the internal cache cleanup     operation failed with an I/O error. With this update,     LDAP special characters in the Distinguished Name (DN)     of a cache entry are escaped before the cleanup     operation starts. As a result, the cleanup operation     completes successfully in the described situation.

  - Applications performing Kerberos authentication     previously increased the memory footprint of the     Kerberos plug-in that parses the Privilege Attribute     Certificate (PAC) information. The plug-in has been     updated to free the memory it allocates, thus fixing     this bug.

  - Previously, when malformed POSIX attributes were defined     in an Active Directory (AD) LDAP server, SSSD     unexpectedly switched to offline mode. This update     relaxes certain checks for AD POSIX attribute validity.
    As a result, SSSD now works as expected even when     malformed POSIX attributes are present in AD and no     longer enters offline mode in the described situation.

After installing the update, the sssd service will be restarted automatically. Additionally, all running applications using the PAC responder plug-in must be restarted for the changes to take effect.

Updated sssd packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

It was found that SSSD's Privilege Attribute Certificate (PAC) responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in. (CVE-2015-5292)

This update also fixes the following bugs :

* Previously, SSSD did not correctly handle sudo rules that applied to groups with names containing special characters, such as the '(' opening parenthesis sign. Consequently, SSSD skipped such sudo rules.
The internal sysdb search has been modified to escape special characters when searching for objects to which sudo rules apply. As a result, SSSD applies the described sudo rules as expected.
(BZ#1258398)

* Prior to this update, SSSD did not correctly handle group names containing special Lightweight Directory Access Protocol (LDAP) characters, such as the '(' or ')' parenthesis signs. When a group name contained one or more such characters, the internal cache cleanup operation failed with an I/O error. With this update, LDAP special characters in the Distinguished Name (DN) of a cache entry are escaped before the cleanup operation starts. As a result, the cleanup operation completes successfully in the described situation.
(BZ#1264098)

* Applications performing Kerberos authentication previously increased the memory footprint of the Kerberos plug-in that parses the Privilege Attribute Certificate (PAC) information. The plug-in has been updated to free the memory it allocates, thus fixing this bug. (BZ#1268783)

* Previously, when malformed POSIX attributes were defined in an Active Directory (AD) LDAP server, SSSD unexpectedly switched to offline mode. This update relaxes certain checks for AD POSIX attribute validity. As a result, SSSD now works as expected even when malformed POSIX attributes are present in AD and no longer enters offline mode in the described situation. (BZ#1268784)

All sssd users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the update, the sssd service will be restarted automatically.
Additionally, all running applications using the PAC responder plug-in must be restarted for the changes to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2019 advisory.

    [1.12.4-47.4]
    - Resolves: rhbz#1268783 - Memory leak / possible DoS with krb auth.

    [1.12.4-47.3]
    - Resolves: rhbz#1268784 - SSSD POSIX attribute check is too strict

    [1.12.4-47.2]
    - Resolves: rhbz#1264098 - cleanup_groups should sanitize dn of groups

    [1.12.4-47.1]
    - Resolves: rhbz#1258398 - sysdb sudo search doesn't escape special                                characters

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
289370	MiracleLinux 7 : sssd-1.13.0-40.el7 (AXSA:2015-829:03)	Nessus	Miracle Linux Local Security Checks	medium
289032	MiracleLinux 4 : sssd-1.12.4-47.AXS4.4 (AXSA:2015-557:03)	Nessus	Miracle Linux Local Security Checks	medium
218759	Linux Distros Unpatched Vulnerability : CVE-2015-5292	Nessus	Misc.	high
89413	Fedora 21 : sssd-1.12.5-4.fc21 (2015-cdea5324a8)	Nessus	Fedora Local Security Checks	medium
89296	Fedora 22 : sssd-1.13.1-2.fc22 (2015-7b47df69d3)	Nessus	Fedora Local Security Checks	medium
89171	Fedora 23 : sssd-1.13.1-2.fc23 (2015-202c127199)	Nessus	Fedora Local Security Checks	medium
87969	Amazon Linux AMI : sssd (ALAS-2016-635)	Nessus	Amazon Linux Local Security Checks	medium
87575	Scientific Linux Security Update : sssd on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	medium
87151	CentOS 7 : sssd (CESA-2015:2355)	Nessus	CentOS Local Security Checks	medium
87095	Oracle Linux 7 : sssd (ELSA-2015-2355)	Nessus	Oracle Linux Local Security Checks	high
86983	RHEL 7 : sssd (RHSA-2015:2355)	Nessus	Red Hat Local Security Checks	medium
86846	Scientific Linux Security Update : sssd on SL6.x i386/x86_64 (20151110)	Nessus	Scientific Linux Local Security Checks	medium
86845	RHEL 6 : sssd (RHSA-2015:2019)	Nessus	Red Hat Local Security Checks	medium
86843	Oracle Linux 6 : sssd (ELSA-2015-2019)	Nessus	Oracle Linux Local Security Checks	high
86831	CentOS 6 : sssd (CESA-2015:2019)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2015-5292

medium

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

high

medium