NVD

Id
8646  
Name
CVE-2011-1758  
Description
The krb5_save_ccname_done function in providers/krb5/krb5_auth.c in System Security Services Daemon (SSSD) 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by listing the /tmp directory to obtain the pathname.  
Reject
 
CVSS Version
2  
CVSS Score
3.7  
Severity
Low  
CVSS Base Score
3.7  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
1.9  
CVSS Vector
(AV:L/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-05-26  
Modified Date
2011-05-27  
Seq
2011-1758  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
49892 8646 CVE-2011-1758 http://git.fedorahosted.org/git/?p=sssd.git;a=commit;h=fffdae81651b460f3d2c119c56d5caa09b4de42a  View
49893 8646 CVE-2011-1758 FEDORA-2011-6279  View
49894 8646 CVE-2011-1758 FEDORA-2011-5815  View
49895 8646 CVE-2011-1758 [oss-security] 20110429 vulnerability in sssd 1.5.0+ (CVE-2011-1758)  View
49896 8646 CVE-2011-1758 https://bugzilla.redhat.com/show_bug.cgi?id=700867  View
49897 8646 CVE-2011-1758 https://bugzilla.redhat.com/show_bug.cgi?id=700891  View
49898 8646 CVE-2011-1758 [sssd-devel] 20110429 SSSD Security Release 1.5.7  View
49899 8646 CVE-2011-1758 https://fedorahosted.org/sssd/ticket/856  View
49900 8646 CVE-2011-1758 https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.7  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34302 JVNDB-2011-004544 SSSD の krb5_save_ccname_done 関数におけるケルベロス認証を回避される脆弱性 System Security Services Daemon (SSSD) の providers/krb5/krb5_auth.c の krb5_save_ccname_done 関数は、自動チケット更新およびオフライン認証が設定される際、パスワードとしてパス名文字列を使うため、ケルベロス認証を回避される脆弱性が存在します。 CVE-2011-1758 49665 CVE-2011-1758 8646 3.7 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004544.html 2011-05-26 2012-03-27 View