CVE-2018-10852

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.

• CVE-2018-10852: create the sudo responder socket with stricter permissions
• CVE-2019-3811: do not return "/" as the home directory when the user has no homedir configured

• CVE-2018-10852: create the sudo responder socket with stricter permissions
• CVE-2019-3811: do not return "/" as the home directory when the user has no homedir configured

Updated sssd packages fix security vulnerability:

The UNIX socket that is used for communication between the sudo utility and the sssd-sudo responder had its permissions set to world-readable and writable, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user (CVE-2018-10852).

These are all security issues fixed in the libipa_hbac-devel-2.5.2-1.4 package on the GA media of openSUSE Tumbleweed.

This update for sssd fixes the following security issue:

• CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377).

This update for sssd provides the following fixes:

This security issue was fixed:

• CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377)

These non-security issues were fixed:

• Fix a segmentation fault in sss_cache command. (bsc#1072728)
• Fix a failure in autofs initialisation sequence upon system boot. (bsc#1010700)
• Fix race condition on boot between SSSD and autofs. (bsc#1010700)
• Fix a bug where file descriptors were not closed (bsc#1080156)
• Fix an issue where sssd logs were not rotated properly (bsc#1080156)
• Remove whitespaces from netgroup entries (bsc#1087320)
• Remove misleading log messages (bsc#1101877)
• exit() the forked process if exec()-ing a child process fails (bsc#1110299)
• Do not schedule the machine renewal task if adcli is not executable (bsc#1110299)

This update for sssd fixes the following issues:

Security vulnerabilities addressed:

• Fix fallback_homedir returning '/' for empty home directories (CVE-2019-3811) (bsc#1121759)
• Create sockets with right permissions (bsc#1098377, CVE-2018-10852)

Other bug fixes and changes:

• Install logrotate configuration (bsc#1004220)
• Strip whitespaces in netgroup triples (bsc#1087320)
• Align systemd service file with upstream
  • Run interactive and change service type to notify (bsc#1120852)
  • Replace deprecated '-f' and use '--logger'

Jakub Hrozek discovered that SSSD incorrectly handled file permissions. A local attacker could possibly use this issue to read the sudo rules available for any user. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10852)

It was discovered that SSSD incorrectly handled Group Policy Objects. When SSSD is configured with too strict permissions causing the GPO to not be readable, SSSD will allow all authenticated users to login instead of being denied, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-16838)

It was discovered that SSSD incorrectly handled users with no home directory set. When no home directory was set, SSSD would return the root directory instead of an empty string, possibly bypassing security measures. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3811)

Cedric Buissart discovered that SSSD incorrectly handled the sssctl command. In certain environments, a local user could use this issue to execute arbitrary commands and possibly escalate privileges. (CVE-2021-3621)