Vulnerability in sssd package - Privilege Escalation
Summary
DLA-3436-2: sssd - regression update. Affects sssd versions < 1.16.3-3.2+deb10u2. Fixed in 1.16.3-3.2+deb10u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The sssd package is a set of daemons that manage access to remote directories and authentication mechanisms. It provides a centralized solution for managing user authentication, authorization, and identity information across multiple systems. The package is commonly used in Linux distributions, including Debian 10 (buster). However, several vulnerabilities have been discovered in the sssd package, which could potentially lead to privilege escalation.
Vulnerability Detail
One of the vulnerabilities, identified as CVE-2018-16838, allows all authenticated users to login instead of denying access when the Group Policy Objects (GPO) are not readable by SSSD due to strict permission settings on the server side. Another vulnerability, CVE-2019-3811, causes sssd to return the root directory instead of an empty string when a user is configured with no home directory set. This could impact services that restrict filesystem access to within the user's home directory. Additionally, CVE-2021-3621 exposes a shell command injection vulnerability in the sssctl command, potentially enabling an attacker to gain root privileges by tricking the root user into running a specially crafted command. Lastly, CVE-2022-4254 affects the libsss_certmap component, allowing LDAP filter injection and potentially leading to full domain takeover.
How To Fix
Minimum fixed version
1.16.3-3.2+deb10u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sssdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The sssd package in Debian 10 (buster) is affected by multiple vulnerabilities that could lead to privilege escalation and unauthorized access. To mitigate these vulnerabilities, it is crucial to upgrade the sssd package to version 1.16.3-3.2+deb10u2 or later. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for sssd →
FAQ
The vulnerabilities in the sssd package could potentially allow an attacker to gain unauthorized access, escalate privileges, or perform command injection attacks. This could lead to unauthorized actions, data breaches, or even full domain takeover.
No, only versions prior to 1.16.3-3.2+deb10u2 are affected. It is recommended to upgrade to the latest version to mitigate the vulnerabilities.
No specific workaround has been provided for these vulnerabilities. It is recommended to upgrade to the fixed version of the sssd package as soon as possible.
The vulnerabilities require an authenticated user to exploit them. However, if an attacker gains legitimate access to a system, they could potentially exploit these vulnerabilities to escalate privileges or perform unauthorized actions.
You can refer to the security tracker page for the sssd package at https://security-tracker.debian.org/tracker/sssd for detailed information about its security status and any other related vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for sssd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
