CVE-2021-3621

SSSD provides a set of daemons to manage access to remote directories and authentication mechanisms such as LDAP, Kerberos or FreeIPA. It provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources.

Security Fix(es):

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2021-3621)

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

Security Fix(es):

• sssd: shell command injection in sssctl (CVE-2021-3621)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

Security Fix(es):

• sssd: shell command injection in sssctl (CVE-2021-3621)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Shell command injection in sssctl. (CVE-2021-3621)

This update for sssd fixes the following issues:

• CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommands (bsc#1189492).
• Add LDAPS support for the AD provider (bsc#1183735).
• Improve logs to record the reason why internal watchdog terminates a process (bsc#1187120).
• Fix watchdog not terminating tasks (bsc#1187120).

These are all security issues fixed in the libipa_hbac-devel-2.9.3-2.1 package on the GA media of openSUSE Tumbleweed.

This update for sssd fixes the following issues:

• Fix a dependency loop by moving internal libraries to sssd-common package. (bsc#1182058)
• Moved sssctl command from sssd to sssd-tools package. (bsc#1184289)
• Create timestamp attribute in cache objects if missing. (bsc#1182637)
• Fix watchdog not terminating tasks. (bsc#1187120)
• Improve logs to record the reason why internal watchdog terminates.
• Fixed security issue with sssd: shell command injection in sssctl. (CVE-2021-3621, bsc#1189492)
• Fixes a segfault with newer libcares2 versions when the library fails to parse a dns name. (bsc#1190021)

This update for sssd fixes the following issues:

• CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommands (bsc#1189492).

This update for sssd fixes the following issues:

• CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommands (bsc#1189492).
• Add LDAPS support for the AD provider (bsc#1183735).
• Improve logs to record the reason why internal watchdog terminates a process (bsc#1187120).
• Fix watchdog not terminating tasks (bsc#1187120).

This update for sssd fixes the following issues:

Security issues fixed:

• CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommands (bsc#1189492).

Non-security issues fixed:

• Create timestamp attribute in cache objects if missing. (bsc#1182637)
• Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte (bsc#1190775).

This update for sssd fixes the following issues:

• CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommands (bsc#1189492).
• Add LDAPS support for the AD provider (bsc#1183735)(jsc#SLE-17773).

Non-security fixes:

• Fixed a crash caused by calling dbus_watch_handle with a corrupted memory value (bsc#1196564).

This update for sssd fixes the following issues:

• CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommand (bsc#1189492).

• Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte (bsc#1190775)

• Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common but baselibs.conf was not updated accordingly (bsc#1182058, bsc#1196166)

• Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552)

Jakub Hrozek discovered that SSSD incorrectly handled file permissions. A local attacker could possibly use this issue to read the sudo rules available for any user. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10852)

It was discovered that SSSD incorrectly handled Group Policy Objects. When SSSD is configured with too strict permissions causing the GPO to not be readable, SSSD will allow all authenticated users to login instead of being denied, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-16838)

It was discovered that SSSD incorrectly handled users with no home directory set. When no home directory was set, SSSD would return the root directory instead of an empty string, possibly bypassing security measures. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3811)

Cedric Buissart discovered that SSSD incorrectly handled the sssctl command. In certain environments, a local user could use this issue to execute arbitrary commands and possibly escalate privileges. (CVE-2021-3621)