Bug 625189 (CVE-2010-2940) - CVE-2010-2940 sssd: allows null password entry to authenticate against LDAP
Summary: CVE-2010-2940 sssd: allows null password entry to authenticate against LDAP
Status: CLOSED ERRATA
Alias: CVE-2010-2940
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: public=20100824,reported=20100809,sou...
Keywords: Security
Depends On: 622583 625122 626879
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-08-18 19:54 UTC by Vincent Danen
Modified: 2015-10-15 21:14 UTC (History)
6 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2012-12-10 04:49:36 UTC


Attachments (Terms of Use)
Patch to disallow zero-length passwords during authentication (1.13 KB, patch)
2010-08-18 20:13 UTC, Stephen Gallagher
no flags Details | Diff

Description Vincent Danen 2010-08-18 19:54:34 UTC
Ted Brunell reported that SSSD, when authenticating against an LDAP server that allows unauthenticated binds, would authenticate users providing an empty password to any service using pam_authenticate (such as the GNOME screensaver).  This could allow a local or remote attacker to gain access to an account without knowing the victim's password.

This flaw can only be exploited if the directory server allows unauthenticated binds, because the directory server will return that the bind was successful if no password is provided.

Acknowledgements:

Red Hat would like to thank Ted Brunell for reporting this issue.

Comment 1 Stephen Gallagher 2010-08-18 20:13:08 UTC
Created attachment 439496 [details]
Patch to disallow zero-length passwords during authentication


Note You need to log in before you can comment on or make changes to this bug.