Vulnerabilities > CVE-2018-10852 - Information Exposure vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Subverting Environment Variable Values The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
- Footprinting An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
- Exploiting Trust in Client (aka Make the Client Invisible) An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
- Browser Fingerprinting An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
- Session Credential Falsification through Prediction This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Nessus
NASL family Huawei Local Security Checks NASL id EULEROS_SA-2018-1403.NASL description According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - sssd: information leak from the sssd-sudo responder.(CVE-2018-10852) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-05-15 modified 2018-12-10 plugin id 119531 published 2018-12-10 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119531 title EulerOS 2.0 SP3 : sssd (EulerOS-SA-2018-1403) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(119531); script_version("1.5"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/13"); script_cve_id( "CVE-2018-10852" ); script_name(english:"EulerOS 2.0 SP3 : sssd (EulerOS-SA-2018-1403)"); script_summary(english:"Checks the rpm output for the updated package."); script_set_attribute(attribute:"synopsis", value: "The remote EulerOS host is missing a security update."); script_set_attribute(attribute:"description", value: "According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - sssd: information leak from the sssd-sudo responder.(CVE-2018-10852) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues."); # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1403 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?35feeb1d"); script_set_attribute(attribute:"solution", value: "Update the affected sssd package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"patch_publication_date", value:"2018/11/29"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/12/10"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libipa_hbac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_autofs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_certmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_nss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_simpleifp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_sudo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python-libipa_hbac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python-libsss_nss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python-sss"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python-sss-murmur"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python-sssdconfig"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-ad"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-common-pac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-dbus"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-ipa"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-krb5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-krb5-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-libwbclient"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-proxy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-tools"); script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Huawei Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp"); script_exclude_keys("Host/EulerOS/uvp_version"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/EulerOS/release"); if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS"); if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0"); sp = get_kb_item("Host/EulerOS/sp"); if (isnull(sp) || sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3"); uvp = get_kb_item("Host/EulerOS/uvp_version"); if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp); if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu); flag = 0; pkgs = ["libipa_hbac-1.15.2-50.8.h2", "libsss_autofs-1.15.2-50.8.h2", "libsss_certmap-1.15.2-50.8.h2", "libsss_idmap-1.15.2-50.8.h2", "libsss_nss_idmap-1.15.2-50.8.h2", "libsss_simpleifp-1.15.2-50.8.h2", "libsss_sudo-1.15.2-50.8.h2", "python-libipa_hbac-1.15.2-50.8.h2", "python-libsss_nss_idmap-1.15.2-50.8.h2", "python-sss-1.15.2-50.8.h2", "python-sss-murmur-1.15.2-50.8.h2", "python-sssdconfig-1.15.2-50.8.h2", "sssd-1.15.2-50.8.h2", "sssd-ad-1.15.2-50.8.h2", "sssd-client-1.15.2-50.8.h2", "sssd-common-1.15.2-50.8.h2", "sssd-common-pac-1.15.2-50.8.h2", "sssd-dbus-1.15.2-50.8.h2", "sssd-ipa-1.15.2-50.8.h2", "sssd-krb5-1.15.2-50.8.h2", "sssd-krb5-common-1.15.2-50.8.h2", "sssd-ldap-1.15.2-50.8.h2", "sssd-libwbclient-1.15.2-50.8.h2", "sssd-proxy-1.15.2-50.8.h2", "sssd-tools-1.15.2-50.8.h2"]; foreach (pkg in pkgs) if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "sssd"); }NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2018-3158.NASL description An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. The following packages have been upgraded to a later upstream version: sssd (1.16.2). (BZ#1558498) Security Fix(es) : * sssd: information leak from the sssd-sudo responder (CVE-2018-10852) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. This issue was discovered by Jakub Hrozek (Red Hat). Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 118533 published 2018-10-31 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118533 title RHEL 7 : sssd (RHSA-2018:3158) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2018:3158. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(118533); script_version("1.5"); script_cvs_date("Date: 2019/10/24 15:35:45"); script_cve_id("CVE-2018-10852"); script_xref(name:"RHSA", value:"2018:3158"); script_name(english:"RHEL 7 : sssd (RHSA-2018:3158)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. The following packages have been upgraded to a later upstream version: sssd (1.16.2). (BZ#1558498) Security Fix(es) : * sssd: information leak from the sssd-sudo responder (CVE-2018-10852) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. This issue was discovered by Jakub Hrozek (Red Hat). Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section." ); # https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?3395ff0b" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:3158" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-10852" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libipa_hbac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libipa_hbac-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsss_autofs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsss_certmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsss_certmap-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsss_idmap-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsss_nss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsss_nss_idmap-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsss_simpleifp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsss_simpleifp-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsss_sudo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-libipa_hbac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-libsss_nss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-sss"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-sss-murmur"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-sssdconfig"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-ad"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-common-pac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-dbus"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-ipa"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-kcm"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-krb5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-krb5-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-libwbclient"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-libwbclient-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-polkit-rules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-proxy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sssd-winbind-idmap"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/26"); script_set_attribute(attribute:"patch_publication_date", value:"2018/10/30"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/31"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2018:3158"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL7", reference:"libipa_hbac-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"libipa_hbac-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libsss_autofs-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libsss_autofs-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"libsss_certmap-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"libsss_certmap-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"libsss_idmap-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"libsss_idmap-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"libsss_nss_idmap-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"libsss_nss_idmap-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"libsss_simpleifp-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"libsss_simpleifp-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libsss_sudo-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libsss_sudo-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"python-libipa_hbac-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-libipa_hbac-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"python-libsss_nss_idmap-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-libsss_nss_idmap-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"python-sss-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-sss-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"python-sss-murmur-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-sss-murmur-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-sssdconfig-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-ad-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-ad-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"sssd-client-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-common-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-common-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-common-pac-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-common-pac-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-dbus-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-dbus-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"sssd-debuginfo-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-ipa-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-ipa-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-kcm-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-kcm-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-krb5-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-krb5-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-krb5-common-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-krb5-common-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-ldap-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-ldap-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-libwbclient-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-libwbclient-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"sssd-libwbclient-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-polkit-rules-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-polkit-rules-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-proxy-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-proxy-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-tools-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-tools-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"sssd-winbind-idmap-1.16.2-13.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"sssd-winbind-idmap-1.16.2-13.el7")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc"); } }NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1411.NASL description According to the versions of the sssd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.(CVE-2018-10852) - It was found that sssd last seen 2020-06-01 modified 2020-06-02 plugin id 124914 published 2019-05-14 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124914 title EulerOS Virtualization for ARM 64 3.0.1.0 : sssd (EulerOS-SA-2019-1411) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(124914); script_version("1.4"); script_cvs_date("Date: 2020/01/17"); script_cve_id( "CVE-2017-12173", "CVE-2018-10852" ); script_name(english:"EulerOS Virtualization for ARM 64 3.0.1.0 : sssd (EulerOS-SA-2019-1411)"); script_summary(english:"Checks the rpm output for the updated packages."); script_set_attribute(attribute:"synopsis", value: "The remote EulerOS Virtualization for ARM 64 host is missing multiple security updates."); script_set_attribute(attribute:"description", value: "According to the versions of the sssd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.(CVE-2018-10852) - It was found that sssd's sysdb_search_user_by_upn_res() function did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.(CVE-2017-12173) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues."); # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1411 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?62c45445"); script_set_attribute(attribute:"solution", value: "Update the affected sssd packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"patch_publication_date", value:"2019/05/07"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/14"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libipa_hbac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_autofs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_certmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_nss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsss_sudo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python-sssdconfig"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-ad"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-common-pac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-ipa"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-krb5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-krb5-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:sssd-proxy"); script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:3.0.1.0"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Huawei Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/EulerOS/release"); if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS"); uvp = get_kb_item("Host/EulerOS/uvp_version"); if (uvp != "3.0.1.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 3.0.1.0"); if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu); if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu); flag = 0; pkgs = ["libipa_hbac-1.16.0-19.5.h3", "libsss_autofs-1.16.0-19.5.h3", "libsss_certmap-1.16.0-19.5.h3", "libsss_idmap-1.16.0-19.5.h3", "libsss_nss_idmap-1.16.0-19.5.h3", "libsss_sudo-1.16.0-19.5.h3", "python-sssdconfig-1.16.0-19.5.h3", "sssd-1.16.0-19.5.h3", "sssd-ad-1.16.0-19.5.h3", "sssd-client-1.16.0-19.5.h3", "sssd-common-1.16.0-19.5.h3", "sssd-common-pac-1.16.0-19.5.h3", "sssd-ipa-1.16.0-19.5.h3", "sssd-krb5-1.16.0-19.5.h3", "sssd-krb5-common-1.16.0-19.5.h3", "sssd-ldap-1.16.0-19.5.h3", "sssd-proxy-1.16.0-19.5.h3"]; foreach (pkg in pkgs) if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "sssd"); }NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2018-3158.NASL description An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. The following packages have been upgraded to a later upstream version: sssd (1.16.2). (BZ#1558498) Security Fix(es) : * sssd: information leak from the sssd-sudo responder (CVE-2018-10852) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. This issue was discovered by Jakub Hrozek (Red Hat). Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 118997 published 2018-11-16 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118997 title CentOS 7 : sssd (CESA-2018:3158) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2018:3158 and # CentOS Errata and Security Advisory 2018:3158 respectively. # include("compat.inc"); if (description) { script_id(118997); script_version("1.3"); script_cvs_date("Date: 2019/12/31"); script_cve_id("CVE-2018-10852"); script_xref(name:"RHSA", value:"2018:3158"); script_name(english:"CentOS 7 : sssd (CESA-2018:3158)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote CentOS host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. The following packages have been upgraded to a later upstream version: sssd (1.16.2). (BZ#1558498) Security Fix(es) : * sssd: information leak from the sssd-sudo responder (CVE-2018-10852) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. This issue was discovered by Jakub Hrozek (Red Hat). Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section." ); # https://lists.centos.org/pipermail/centos-cr-announce/2018-November/005657.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?23c68e4a" ); script_set_attribute(attribute:"solution", value:"Update the affected sssd packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-10852"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libipa_hbac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libipa_hbac-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsss_autofs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsss_certmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsss_certmap-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsss_idmap-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsss_nss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsss_nss_idmap-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsss_simpleifp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsss_simpleifp-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsss_sudo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:python-libipa_hbac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:python-libsss_nss_idmap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:python-sss"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:python-sss-murmur"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:python-sssdconfig"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-ad"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-common-pac"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-dbus"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-ipa"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-kcm"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-krb5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-krb5-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-libwbclient"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-libwbclient-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-polkit-rules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-proxy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:sssd-winbind-idmap"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/26"); script_set_attribute(attribute:"patch_publication_date", value:"2018/11/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/16"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"CentOS Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/CentOS/release"); if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS"); os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 7.x", "CentOS " + os_ver); if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu); flag = 0; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libipa_hbac-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libipa_hbac-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsss_autofs-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsss_certmap-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsss_certmap-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsss_idmap-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsss_idmap-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsss_nss_idmap-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsss_nss_idmap-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsss_simpleifp-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsss_simpleifp-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsss_sudo-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"python-libipa_hbac-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"python-libsss_nss_idmap-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"python-sss-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"python-sss-murmur-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"python-sssdconfig-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-ad-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-client-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-common-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-common-pac-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-dbus-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-ipa-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-kcm-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-krb5-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-krb5-common-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-ldap-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-libwbclient-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-libwbclient-devel-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-polkit-rules-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-proxy-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-tools-1.16.2-13.el7")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"sssd-winbind-idmap-1.16.2-13.el7")) flag++; if (flag) { cr_plugin_caveat = '\n' + 'NOTE: The security advisory associated with this vulnerability has a\n' + 'fixed package version that may only be available in the continuous\n' + 'release (CR) repository for CentOS, until it is present in the next\n' + 'point release of CentOS.\n\n' + 'If an equal or higher package level does not exist in the baseline\n' + 'repository for your major version of CentOS, then updates from the CR\n' + 'repository will need to be applied in order to address the\n' + 'vulnerability.\n'; security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + cr_plugin_caveat ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc"); }NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-51.NASL description This update for sssd provides the following fixes : This security issue was fixed : - CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377) These non-security issues were fixed : - Fix a segmentation fault in sss_cache command. (bsc#1072728) - Fix a failure in autofs initialisation sequence upon system boot. (bsc#1010700) - Fix race condition on boot between SSSD and autofs. (bsc#1010700) - Fix a bug where file descriptors were not closed (bsc#1080156) - Fix an issue where sssd logs were not rotated properly (bsc#1080156) - Remove whitespaces from netgroup entries (bsc#1087320) - Remove misleading log messages (bsc#1101877) - exit() the forked process if exec()-ing a child process fails (bsc#1110299) - Do not schedule the machine renewal task if adcli is not executable (bsc#1110299) This update was imported from the SUSE:SLE-12-SP2:Update update project. last seen 2020-03-18 modified 2019-01-14 plugin id 121157 published 2019-01-14 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121157 title openSUSE Security Update : sssd (openSUSE-2019-51) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1193.NASL description According to the version of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.i1/4^CVE-2018-10852i1/4%0 Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-19 modified 2019-04-09 plugin id 123879 published 2019-04-09 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123879 title EulerOS Virtualization 2.5.4 : sssd (EulerOS-SA-2019-1193) NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-0081-1.NASL description This update for sssd provides the following fixes : This security issue was fixed : CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-18 modified 2019-01-14 plugin id 121159 published 2019-01-14 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121159 title SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:0081-1) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2018-1429.NASL description According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - sssd: information leak from the sssd-sudo responder.(CVE-2018-10852) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-05-06 modified 2018-12-28 plugin id 119918 published 2018-12-28 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119918 title EulerOS 2.0 SP2 : sssd (EulerOS-SA-2018-1429) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2018-3158.NASL description From Red Hat Security Advisory 2018:3158 : An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. The following packages have been upgraded to a later upstream version: sssd (1.16.2). (BZ#1558498) Security Fix(es) : * sssd: information leak from the sssd-sudo responder (CVE-2018-10852) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. This issue was discovered by Jakub Hrozek (Red Hat). Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 118776 published 2018-11-07 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118776 title Oracle Linux 7 : sssd (ELSA-2018-3158) NASL family SuSE Local Security Checks NASL id OPENSUSE-2018-847.NASL description This update for sssd fixes the following security issue : - CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377). This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-05 modified 2018-08-10 plugin id 111628 published 2018-08-10 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111628 title openSUSE Security Update : sssd (openSUSE-2018-847) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-574.NASL description This update for sssd fixes the following security issue : - CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377). This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 123249 published 2019-03-27 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123249 title openSUSE Security Update : sssd (openSUSE-2019-574) NASL family NewStart CGSL Local Security Checks NASL id NEWSTART_CGSL_NS-SA-2019-0067_SSSD.NASL description The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sssd packages installed that are affected by a vulnerability: - The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. (CVE-2018-10852) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 127267 published 2019-08-12 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127267 title NewStart CGSL CORE 5.04 / MAIN 5.04 : sssd Vulnerability (NS-SA-2019-0067) NASL family Amazon Linux Local Security Checks NASL id AL2_ALAS-2018-1127.NASL description The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.(CVE-2018-10852) last seen 2020-03-28 modified 2018-12-20 plugin id 119782 published 2018-12-20 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119782 title Amazon Linux 2 : sssd (ALAS-2018-1127) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1429.NASL description The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. For Debian 8 last seen 2020-06-01 modified 2020-06-02 plugin id 111111 published 2018-07-17 reporter This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111111 title Debian DLA-1429-1 : sssd security update NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-0556-1.NASL description This update for sssd fixes the following issues : Security vulnerabilities addressed : Fix fallback_homedir returning last seen 2020-06-01 modified 2020-06-02 plugin id 122665 published 2019-03-07 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/122665 title SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:0556-1) NASL family Scientific Linux Local Security Checks NASL id SL_20181030_SSSD_ON_SL7_X.NASL description Security Fix(es) : - sssd: information leak from the sssd-sudo responder (CVE-2018-10852) last seen 2020-03-18 modified 2018-11-27 plugin id 119200 published 2018-11-27 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119200 title Scientific Linux Security Update : sssd on SL7.x x86_64 (20181030) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2018-1127.NASL description The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. (CVE-2018-10852) last seen 2020-03-17 modified 2019-01-25 plugin id 121360 published 2019-01-25 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121360 title Amazon Linux AMI : sssd (ALAS-2018-1127) NASL family SuSE Local Security Checks NASL id SUSE_SU-2018-2144-1.NASL description This update for sssd fixes the following security issue : - CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-21 modified 2019-01-02 plugin id 120068 published 2019-01-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120068 title SUSE SLED15 / SLES15 Security Update : sssd (SUSE-SU-2018:2144-1)
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| rpms |
|
References
- http://www.securityfocus.com/bid/104547
- http://www.securityfocus.com/bid/104547
- https://access.redhat.com/errata/RHSA-2018:3158
- https://access.redhat.com/errata/RHSA-2018:3158
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10852
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10852
- https://lists.debian.org/debian-lts-announce/2018/07/msg00019.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00019.html