SB2019080621 - Red Hat update for sssd

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019080621

SB2019080621 - Red Hat update for sssd

Published: August 6, 2019 Updated: May 9, 2023

Security Bulletin ID SB2019080621
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security restrictions bypass (CVE-ID: CVE-2018-16838)

The vulnerability allows a remote authenticated attacker to bypass security restrictions on the system.

The vulnerability exists due to a flaw in sssd Group Policy Objects implementation when the GPO is not readable by SSSD due to a too strict permission settings on the server side. A remote attacker can bypass security restrictions.


2) Improper access control (CVE-ID: CVE-2019-3811)

The vulnerability allows an adjacent authenticated attacker to bypass security restrictions.

The vulnerability exists due to the return of '/' (the root directory) instead of '' (the empty string / no home directory) if a user was configured with no home directory set. An adjacent attacker can bypass services that restrict the user's filesystem access to within their home directory through chroot().


Remediation

Install update from vendor's website.

References