CVE-2019-3811

A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.

• CVE-2018-10852: create the sudo responder socket with stricter permissions
• CVE-2019-3811: do not return "/" as the home directory when the user has no homedir configured

• CVE-2018-10852: create the sudo responder socket with stricter permissions
• CVE-2019-3811: do not return "/" as the home directory when the user has no homedir configured

Garming Sam reported an out-of-bounds read in the ldb_wildcard_compare() function of ldb, resulting in denial of service (CVE-2019-3824).

The ldb package has been updated to version 1.2.4 to fix this issue. The sssd and samba packages have been rebuilt against the updated ldb.

If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable. (CVE-2019-3811)

This update for sssd fixes the following issues:

Security vulnerability addresed:

• CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759)

Other bug fixes and changes:

• Install logrotate configuration (bsc#1004220)
• Align systemd service file with upstream, run interactive and change service type to notify (bsc#1120852)
• Fix sssd not starting in foreground mode (bsc#1125277)
• Strip whitespaces in netgroup triples (bsc#1087320)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libipa_hbac-devel-2.9.3-2.1 package on the GA media of openSUSE Tumbleweed.

This update for sssd fixes the following issues:

Security vulnerability addresed:

• CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759)

Other bug fixes and changes:

• Install logrotate configuration (bsc#1004220)
• Align systemd service file with upstream, run interactive and change service type to notify (bsc#1120852)
• Fix sssd not starting in foreground mode (bsc#1125277)
• Strip whitespaces in netgroup triples (bsc#1087320)

This update for sssd fixes the following issues:

Security vulnerability fixed:

• CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759)

Other bug fixes and changes:

• Skip sdap_save_grpmem() if ignore_group_members is set. (bsc#1082568)
• Only search for primary group if it is not already cached (bsc#1082568)
• Install /var/lib/sss/mc directory to correct sssd cache invalidation behaviour. Spec patch authored by Josef Cejka. (bsc#1039567) to fix a segfault in sudo provider (bsc#977224).
• Fix a segfault in sss_cache (bsc#976038).

This update for sssd fixes the following issues:

Security vulnerabilities addressed:

• Fix fallback_homedir returning '/' for empty home directories (CVE-2019-3811) (bsc#1121759)
• Create sockets with right permissions (bsc#1098377, CVE-2018-10852)

Other bug fixes and changes:

• Install logrotate configuration (bsc#1004220)
• Strip whitespaces in netgroup triples (bsc#1087320)
• Align systemd service file with upstream
  • Run interactive and change service type to notify (bsc#1120852)
  • Replace deprecated '-f' and use '--logger'

This update for adcli and sssd provides the following improvement:

Security vulnerability fixed:

• CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759)

Other fixes:

• Add an option to disable checking for trusted domains in the subdomains provider (bsc#1125617)
• Clear pid file in corner cases (bsc#1127670)
• Fix child unable to write to log file after SIGHUP (bsc#1127670)
• Include adcli in SUSE Linux Enterprise 12 SP3 for sssd-ad. (fate#326619, bsc#1109849)

The adcli enables sssd to do password renewal when using Active Directory.

Jakub Hrozek discovered that SSSD incorrectly handled file permissions. A local attacker could possibly use this issue to read the sudo rules available for any user. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10852)

It was discovered that SSSD incorrectly handled Group Policy Objects. When SSSD is configured with too strict permissions causing the GPO to not be readable, SSSD will allow all authenticated users to login instead of being denied, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-16838)

It was discovered that SSSD incorrectly handled users with no home directory set. When no home directory was set, SSSD would return the root directory instead of an empty string, possibly bypassing security measures. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3811)

Cedric Buissart discovered that SSSD incorrectly handled the sssctl command. In certain environments, a local user could use this issue to execute arbitrary commands and possibly escalate privileges. (CVE-2021-3621)