CVE-2011-1758

2011-05-2618:55:02

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

3.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:H/Au:N/C:P/I:P/A:P

EPSS

Percentile

5.1%

JSON

The krb5_save_ccname_done function in providers/krb5/krb5_auth.c in System Security Services Daemon (SSSD) 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by listing the /tmp directory to obtain the pathname.

OSVersionArchitecturePackageVersionFilename
Debian12allsssd< 2.8.2-4sssd_2.8.2-4_all.deb
Debian11allsssd< 2.4.1-2sssd_2.4.1-2_all.deb
Debian999allsssd< 2.9.5-3sssd_2.9.5-3_all.deb
Debian13allsssd< 2.9.5-3sssd_2.9.5-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	sssd	< 2.8.2-4	sssd_2.8.2-4_all.deb
Debian	11	all	sssd	< 2.4.1-2	sssd_2.4.1-2_all.deb
Debian	999	all	sssd	< 2.9.5-3	sssd_2.9.5-3_all.deb
Debian	13	all	sssd	< 2.9.5-3	sssd_2.9.5-3_all.deb