Bug 625189 - (CVE-2010-2940) CVE-2010-2940 sssd: allows null password entry to authenticate against LDAP
CVE-2010-2940 sssd: allows null password entry to authenticate against LDAP
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
public=20100824,reported=20100809,sou...
: Security
Depends On: 622583 625122 626879
Blocks:
  Show dependency treegraph
 
Reported: 2010-08-18 15:54 EDT by Vincent Danen
Modified: 2015-10-15 17:14 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-12-09 23:49:36 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Patch to disallow zero-length passwords during authentication (1.13 KB, patch)
2010-08-18 16:13 EDT, Stephen Gallagher
no flags Details | Diff

  None (edit)
Description Vincent Danen 2010-08-18 15:54:34 EDT
Ted Brunell reported that SSSD, when authenticating against an LDAP server that allows unauthenticated binds, would authenticate users providing an empty password to any service using pam_authenticate (such as the GNOME screensaver).  This could allow a local or remote attacker to gain access to an account without knowing the victim's password.

This flaw can only be exploited if the directory server allows unauthenticated binds, because the directory server will return that the bind was successful if no password is provided.

Acknowledgements:

Red Hat would like to thank Ted Brunell for reporting this issue.
Comment 1 Stephen Gallagher 2010-08-18 16:13:08 EDT
Created attachment 439496 [details]
Patch to disallow zero-length passwords during authentication

Note You need to log in before you can comment on or make changes to this bug.