|Category:||Red Hat Local Security Checks|
|Title:||RedHat Update for sssd RHSA-2015:2355-01|
|Summary:||The remote host is missing an update for the 'sssd'; package(s) announced via the referenced advisory.|
The remote host is missing an update for the 'sssd'
package(s) announced via the referenced advisory.
The System Security Services Daemon (SSSD)
service provides a set of daemons to manage access to remote directories and
It was found that SSSD's Privilege Attribute Certificate (PAC) responder
plug-in would leak a small amount of memory on each authentication request.
A remote attacker could potentially use this flaw to exhaust all available
memory on the system by making repeated requests to a Kerberized daemon
application configured to authenticate using the PAC responder plug-in.
The sssd packages have been upgraded to upstream version 1.13.0, which
provides a number of bug fixes and enhancements over the previous version.
Several enhancements are described in the Red Hat Enterprise Linux 7.2
Release Notes, linked to in the References section:
* SSSD smart card support (BZ#854396)
* Cache authentication in SSSD (BZ#910187)
* SSSD supports overriding automatically discovered AD site (BZ#1163806)
* SSSD can now deny SSH access to locked accounts (BZ#1175760)
* SSSD enables UID and GID mapping on individual clients (BZ#1183747)
* Background refresh of cached entries (BZ#1199533)
* Multi-step prompting for one-time and long-term passwords (BZ#1200873)
* Caching for initgroups operations (BZ#1206575)
* When the SELinux user content on an IdM server was set to an empty
string, the SSSD SELinux evaluation utility returned an error. (BZ#1192314)
* If the ldap_child process failed to initialize credentials and exited
with an error multiple times, operations that create files in some cases
started failing due to an insufficient amount of i-nodes. (BZ#1198477)
* The SRV queries used a hard coded TTL timeout, and environments that
wanted the SRV queries to be valid for a certain time only were blocked.
Now, SSSD parses the TTL value out of the DNS packet. (BZ#1199541)
* Previously, initgroups operation took an excessive amount of time. Now,
logins and ID processing are faster for setups with AD back end and
disabled ID mapping. (BZ#1201840)
* When an IdM client with Red Hat Enterprise Linux 7.1 or later was
connecting to a server with Red Hat Enterprise Linux 7.0 or earlier,
authentication with an AD trusted domain caused the sssd_be process to
terminate unexpectedly. (BZ#1202170)
* If replication conflict entries appeared during HBAC processing, the user
was denied access. Now, the replication conflict entries are skipped and
users are permitted access. (BZ#1202245)
* The array of SIDs no longer contains an uninitialized value and SSSD no
longer crashes. (BZ#1204203)
* SSSD supports GPOs from diffe ...
Description truncated, please see the referenced URL(s) for more information.
sssd on Red Hat Enterprise Linux Server (v. 7)
Please Install the Updated Packages.
Common Vulnerability Exposure (CVE) ID: CVE-2015-5292|
BugTraq ID: 77529
RedHat Security Advisories: RHSA-2015:2019
RedHat Security Advisories: RHSA-2015:2355
|Copyright||Copyright (C) 2015 Greenbone Networks GmbH|
|This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.