=============== A security bug in SSSD 1.10 and later ==============
= Subject: A memory leak was found in SSSD's PAC processing plugin
= CVE ID#: CVE-2015-5292
= Summary: When SSSD's PAC responder is configured and a user login
= triggers parsing of the PAC blob (typically a GSSAPI
= password-less login), a small amount of memory is leaked
= in the context of the Kerberized application. This can
= eventually lead to memory exhaustion.
= Impact: Low
= Acknowledgements: This bug was found by Thomas Oulevey from CERN
= Affects default
= configuration: Only for the IPA provider
= Introduced with: 1.10.0 beta2
==== DESCRIPTION ====
When SSSD's PAC responder is configured and a user login triggers parsing of
the PAC blob (typically a GSSAPI password-less login), a small amount of
memory is leaked in the context of the Kerberized application. This can
eventually lead to memory exhaustion.
The affected configration would include "pac" in the list of services in
the the "[sssd]" section of the /etc/sssd/sssd.conf config file. Please
note that SSSD automatically starts the PAC responder in case the provider
type is set to IPA.
Also note that the most widely deployed application with this configuration
is OpenSSH, where the bug is not noticeable because, the leak happens in
a short-lived child process, not the long-running deamon.
The fix was delivered as part of the 1.13.1 release. However, the security
implications of the bug were only determined later.
The bug is being tracked in the following Red Hat Bugzilla report:
==== PATCH AVAILABILITY ====
The patch is available at:
We can't search of overridden name/id in LDAP when using local
overrides. These patches fix this for nss and sudo responder, please let
me know if there is any other place.
Similar fix needs to be done in cache_req interface, but I'll send it as
another patch since I have some work in progress in that area.
to help the OpenSCAP integration, I prepared a wiki page that contains
options which have a security impact -- either positive (drop root) or
negative (ignore certificate validation issues).
I also tried to explain the effect of the options along with the
description. There are some more items that can be included, but I
wasn't sure about them myself, like:
* should obfuscated passwords be mentioned? I wasn't sure because on
one hand it really doesn't provide any benefit, on the other hand,
the option can be used to check a compliance box that requires no
passwords be stored in files..
* should the page warn against the
auth-option-that-shall-not-be-mentioned or politely deny its
* What about fd_limit ? Should resource consumption be considered
a security property, especially if we already honor system default? I
think here the default is enough, so I didn't document that option.
Please provide your comments or edit the wiki directly. Thanks!
while messing around with some code analyses tool I noticed that some header files are not including directly header files which they use and thus are dependent on being included in particular order.
Please see simple patch attached that fixes some of such files (but definitely not all).
Use extra flag also in OOB request.
Provide support for UPN. This add an improvement from NSS code, but I'm
not sure if it is desired or not.
If you have [domain/AD.PB] in sssd.conf and UPN "upn(a)ad.pb" then NSS
responder will not find this user, cache_req will. Is this nss behavior
intentional or a bug?
I got really sick of the way new test are written in cache_req when
writing new tests so I kinda rewrote it.
I tried to setup sssd on my fedora using the following instructions:
Didn't succeed yet, but some issues of the documentation are given
* It says "I suggest that you start with the /etc/sssd/sssd.conf file
that comes with the Fedora RPMs as it contains comments to aid you"
There is no sssd.conf coming from the fedora RPMs. Most likely it means
copy "/usr/share/doc/sssd-common/sssd-example.conf" to
* It asks to start the service prior to having a working config file
* It uses "service sssd start" instead of systemctl start sssd in