CVE-2009-2410

2009-07-3018:30:00

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.006

Percentile

79.2%

JSON

The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account’s username, in conjunction with an arbitrary password, over an ssh connection.

OSVersionArchitecturePackageVersionFilename
Debian12allsssd< 2.8.2-4sssd_2.8.2-4_all.deb
Debian11allsssd< 2.4.1-2sssd_2.4.1-2_all.deb
Debian999allsssd< 2.9.5-3sssd_2.9.5-3_all.deb
Debian13allsssd< 2.9.5-3sssd_2.9.5-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	sssd	< 2.8.2-4	sssd_2.8.2-4_all.deb
Debian	11	all	sssd	< 2.4.1-2	sssd_2.4.1-2_all.deb
Debian	999	all	sssd	< 2.9.5-3	sssd_2.9.5-3_all.deb
Debian	13	all	sssd	< 2.9.5-3	sssd_2.9.5-3_all.deb