[SSSD] Announcing SSSD 1.0.1 Security Release

Stephen Gallagher sgallagh at redhat.com
Mon Jan 11 14:12:57 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Last week, the SSSD team discovered a security flaw in SSSD 1.0.0. It
has been designated CVE-2010-0014

When sssd is configured to use Kerberos for authentication
(auth_provider = krb5 in a domain section) any password is accepted as
valid when all of the following conditions are met:
 - the system is offline, i.e. the KDC configured with the option
   krb5_kdcip cannot be reached
 - the user who tries to authenticate has a valid TGT for the Kerberos
   realm served by SSSD in his credential cache file

SSSD 1.0.1 has now been released and is available at
https://fedorahosted.org/sssd/ for download immediately.

This is a serious vulnerability, and anyone using Kerberos auth
through the SSSD should update to this version as soon as possible.


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAktLMekACgkQeiVVYja6o6MZ7wCbBCW3bkUU5ySbSV4ZRR2kJW9k
Qa4AnjHPhaFsDyFlr5HjNl0rjT/ZRgqk
=tdHp
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list