-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Last week, the SSSD team discovered a security flaw in SSSD 1.0.0. It
has been designated CVE-2010-0014
When sssd is configured to use Kerberos for authentication
(auth_provider = krb5 in a domain section) any password is accepted as
valid when all of the following conditions are met:
- the system is offline, i.e. the KDC configured with the option
krb5_kdcip cannot be reached
- the user who tries to authenticate has a valid TGT for the Kerberos
realm served by SSSD in his credential cache file
SSSD 1.0.1 has now been released and is available at
https://fedorahosted.org/sssd/ for download immediately.
This is a serious vulnerability, and anyone using Kerberos auth
through the SSSD should update to this version as soon as possible.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAktLMekACgkQeiVVYja6o6MZ7wCbBCW3bkUU5ySbSV4ZRR2kJW9k
Qa4AnjHPhaFsDyFlr5HjNl0rjT/ZRgqk
=tdHp
-----END PGP SIGNATURE-----