-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
During internal testing and review, we discovered that the 0.99.1
preview release contained a security bug.
On SSSD configurations using Kerberos 5 for authentication with cached
credentials enabled, users of the Kerberos domain were able to
successfully authenticate with a zero-length password. The kerberos
child process (which performs kerberos auth on behalf of the user in
order to guarantee correct ownership of the credential cache) was
interpreting a zero-length password as an offline authentication attempt
and was generating the special expired credential cache that an offline
login would have instead of authenticating against the KDC. The attached
patch ensures that we do not treat zero-length passwords as successful
offline authentications.
This security flaw exists ONLY in the 0.99.x release candidate series,
and not in 0.7.1 or other stable releases.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAksr62MACgkQeiVVYja6o6PJCwCghXK54OGA2nDVKXkHcGP8h2YY
LAsAnR08vMF5hNtaKXE5CtUwF6tIDC5f
=zb3n
-----END PGP SIGNATURE-----