The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 21.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5067-1 advisory.

  - A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to     a too strict permission settings on the server side, SSSD will allow all authenticated users to login     instead of denying access. (CVE-2018-16838)

  - The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide     permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD     use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
    (CVE-2018-10852)

  - A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services     that restrict the user's filesystem access to within their home directory through chroot() etc. All     versions before 2.1 are vulnerable. (CVE-2019-3811)

  - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-     fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a     specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3621)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sssd packages installed that are affected by a vulnerability:

  - The UNIX pipe which sudo uses to contact SSSD and read     the available sudo rules from SSSD utilizes too broad of     a set of permissions. Any user who can send a message     using the same raw protocol that sudo and SSSD use can     read the sudo rules available for any user.
    (CVE-2018-10852)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the sssd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The UNIX pipe which sudo uses to contact SSSD and read     the available sudo rules from SSSD utilizes too broad     of a set of permissions. Any user who can send a     message using the same raw protocol that sudo and SSSD     use can read the sudo rules available for any     user.(CVE-2018-10852)

  - It was found that sssd's sysdb_search_user_by_upn_res()     function did not sanitize requests when querying its     local cache and was vulnerable to injection. In a     centralized login environment, if a password hash was     locally cached for a given user, an authenticated     attacker could use this flaw to retrieve     it.(CVE-2017-12173)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The UNIX pipe which sudo uses to contact SSSD and read     the available sudo rules from SSSD utilizes too broad     of a set of permissions. Any user who can send a     message using the same raw protocol that sudo and SSSD     use can read the sudo rules available for any     user.i1/4^CVE-2018-10852i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sssd fixes the following security issue :

  - CVE-2018-10852: Set stricter permissions on     /var/lib/sss/pipes/sudo to prevent the disclosure of     sudo rules for arbitrary users (bsc#1098377).

This update was imported from the SUSE:SLE-15:Update update project.

This update for sssd fixes the following issues :

Security vulnerabilities addressed :

Fix fallback_homedir returning '/' for empty home directories (CVE-2019-3811) (bsc#1121759)

Create sockets with right permissions (bsc#1098377, CVE-2018-10852)

Other bug fixes and changes: Install logrotate configuration (bsc#1004220)

Strip whitespaces in netgroup triples (bsc#1087320)

Align systemd service file with upstream

  - Run interactive and change service type to notify     (bsc#1120852)

  - Replace deprecated '-f' and use '--logger'

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.
(CVE-2018-10852)

This update for sssd provides the following fixes :

This security issue was fixed :

CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sssd provides the following fixes :

This security issue was fixed :

  - CVE-2018-10852: Set stricter permissions on     /var/lib/sss/pipes/sudo to prevent the disclosure of     sudo rules for arbitrary users (bsc#1098377)

These non-security issues were fixed :

  - Fix a segmentation fault in sss_cache command.
    (bsc#1072728)

  - Fix a failure in autofs initialisation sequence upon     system boot. (bsc#1010700)

  - Fix race condition on boot between SSSD and autofs.
    (bsc#1010700)

  - Fix a bug where file descriptors were not closed     (bsc#1080156)

  - Fix an issue where sssd logs were not rotated properly     (bsc#1080156)

  - Remove whitespaces from netgroup entries (bsc#1087320)

  - Remove misleading log messages (bsc#1101877)

  - exit() the forked process if exec()-ing a child process     fails (bsc#1110299)

  - Do not schedule the machine renewal task if adcli is not     executable (bsc#1110299)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for sssd fixes the following security issue :

  - CVE-2018-10852: Set stricter permissions on     /var/lib/sss/pipes/sudo to prevent the disclosure of     sudo rules for arbitrary users (bsc#1098377).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - sssd: information leak from the sssd-sudo     responder.(CVE-2018-10852)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.(CVE-2018-10852)

Security Fix(es) :

  - sssd: information leak from the sssd-sudo responder     (CVE-2018-10852)

An update for sssd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

The following packages have been upgraded to a later upstream version:
sssd (1.16.2). (BZ#1558498)

Security Fix(es) :

* sssd: information leak from the sssd-sudo responder (CVE-2018-10852)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Jakub Hrozek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

From Red Hat Security Advisory 2018:3158 :

An update for sssd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

The following packages have been upgraded to a later upstream version:
sssd (1.16.2). (BZ#1558498)

Security Fix(es) :

* sssd: information leak from the sssd-sudo responder (CVE-2018-10852)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Jakub Hrozek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.

For Debian 8 'Jessie', these problems have been fixed in version 1.11.7-3+deb8u1.

We recommend that you upgrade your sssd packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
153144	Ubuntu 18.04 LTS / 20.04 LTS : SSSD vulnerabilities (USN-5067-1)	Nessus	Ubuntu Local Security Checks	high
127267	NewStart CGSL CORE 5.04 / MAIN 5.04 : sssd Vulnerability (NS-SA-2019-0067)	Nessus	NewStart CGSL Local Security Checks	high
124914	EulerOS Virtualization for ARM 64 3.0.1.0 : sssd (EulerOS-SA-2019-1411)	Nessus	Huawei Local Security Checks	high
123879	EulerOS Virtualization 2.5.4 : sssd (EulerOS-SA-2019-1193)	Nessus	Huawei Local Security Checks	high
123249	openSUSE Security Update : sssd (openSUSE-2019-574)	Nessus	SuSE Local Security Checks	high
122665	SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:0556-1)	Nessus	SuSE Local Security Checks	high
121360	Amazon Linux AMI : sssd (ALAS-2018-1127)	Nessus	Amazon Linux Local Security Checks	high
121159	SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:0081-1)	Nessus	SuSE Local Security Checks	high
121157	openSUSE Security Update : sssd (openSUSE-2019-51)	Nessus	SuSE Local Security Checks	high
120068	SUSE SLED15 / SLES15 Security Update : sssd (SUSE-SU-2018:2144-1)	Nessus	SuSE Local Security Checks	high
119918	EulerOS 2.0 SP2 : sssd (EulerOS-SA-2018-1429)	Nessus	Huawei Local Security Checks	high
119782	Amazon Linux 2 : sssd (ALAS-2018-1127)	Nessus	Amazon Linux Local Security Checks	high
119531	EulerOS 2.0 SP3 : sssd (EulerOS-SA-2018-1403)	Nessus	Huawei Local Security Checks	high
119200	Scientific Linux Security Update : sssd on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	high
118997	CentOS 7 : sssd (CESA-2018:3158)	Nessus	CentOS Local Security Checks	high
118776	Oracle Linux 7 : sssd (ELSA-2018-3158)	Nessus	Oracle Linux Local Security Checks	high
118533	RHEL 7 : sssd (RHSA-2018:3158)	Nessus	Red Hat Local Security Checks	high
111628	openSUSE Security Update : sssd (openSUSE-2018-847)	Nessus	SuSE Local Security Checks	high
111111	Debian DLA-1429-1 : sssd security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-10852

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high