Fedora SSSD BE数据库无密码认证绕过漏洞

Bugraq ID: 35868 CVE ID：CVE-2009-2410 Fedora是一款基于linux内核的发行版本。 Fedora SSSD存在验证绕过问题，远程攻击者可以利用漏洞获得对目标系统的未授权访问。 如果用户增加到SSSD BE数据库，但没有设置密码，那么这个用户就可以通过SSH连接配置SSSD客户端机器，并无需任何密码即可访问。 RedHat SSSD 0.4.1-2 RedHat Fedora 11 厂商解决方案 用户可参考如下安全公告获得补丁信息： https://bugzilla.redhat.com/showbug.cgi?id=514057...

CVE-2009-2410: Improper Authentication

The localhandlercallback function in server/responder/pam/pamLOCALdomain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password...

Fedora 11 : sssd-0.4.1-3.fc11 (2009-8101)

If a user was added to the SSSD BE database without setting a password, the user could ssh to the SSSD configured client and enter any password to gain access. This update resolves this issue so users with no password set are no longer able to login. Note that Tenable Network Security has extract...

[SECURITY] Fedora 11 Update: sssd-0.4.1-3.fc11

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the basis to provide client auditing and policy servic...