Bug 625189 (CVE-2010-2940)

Summary: CVE-2010-2940 sssd: allows null password entry to authenticate against LDAP
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: djorm, jgalipea, rcvalle, security-response-team, sgallagh, t.h.amundsen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: public=20100824,reported=20100809,source=researcher,impact=important,cvss2=7.5/AV:N/AC:L/Au:N/C:P/I:P/A:P,fedora-all/sssd=affected,rhel-6/sssd=notaffected,rhel-5/sssd=affected,cwe=CWE-284
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-12-10 04:49:36 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 622583, 625122, 626879    
Bug Blocks:    
Attachments:
Description Flags
Patch to disallow zero-length passwords during authentication none

Description Vincent Danen 2010-08-18 19:54:34 UTC 
Ted Brunell reported that SSSD, when authenticating against an LDAP server that allows unauthenticated binds, would authenticate users providing an empty password to any service using pam_authenticate (such as the GNOME screensaver).  This could allow a local or remote attacker to gain access to an account without knowing the victim's password.

This flaw can only be exploited if the directory server allows unauthenticated binds, because the directory server will return that the bind was successful if no password is provided.

Acknowledgements:

Red Hat would like to thank Ted Brunell for reporting this issue.
Comment 1 Stephen Gallagher 2010-08-18 20:13:08 UTC 
Created attachment 439496 [details]
Patch to disallow zero-length passwords during authentication