NVD

Id
49657  
Name
CVE-2009-2410  
Description
The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account"s username, in conjunction with an arbitrary password, over an ssh connection.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-07-30  
Modified Date
2009-08-08  
Seq
2009-2410  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
250948 49657 CVE-2009-2410 35868  View
250949 49657 CVE-2009-2410 sssd-localhandlercallback-security-bypass(52210)  View
250950 49657 CVE-2009-2410 https://bugzilla.redhat.com/attachment.cgi?id=355424  View
250951 49657 CVE-2009-2410 https://bugzilla.redhat.com/show_bug.cgi?id=514057  View
250952 49657 CVE-2009-2410 FEDORA-2009-8101  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
42601 JVNDB-2009-003608 sssd の local_handler_callback 関数におけるアクセス権を取得される脆弱性 sssd の server/responder/pam/pam_LOCAL_domain.c の local_handler_callback 関数は、SSSD BE データベース内の空白パスワードが設定されたアカウントを適切に処理しないため、アクセス権を取得される脆弱性が存在します。 CVE-2009-2410 39841 CVE-2009-2410 49657 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003608.html 2009-07-30 2012-06-26 View