A security bug in SSSD 1.12 and later (CVE-2017-12173)
by Sumit Bose
=============== A security bug in SSSD 1.12 and later =========================
=
= Subject: Unsanitized input when searching in local cache database
=
= CVE ID#: CVE-2017-12173
=
= Summary: SSSD stores its cached data in an LDAP like local database
= file using libldb. To lookup cached data LDAP search
= filters like '(objectClass=user)(name=user_name)' are used.
= However, in sysdb_search_user_by_upn_res(), the input is
= not sanitized and allows to manipulate the search filter
= for cache lookups.
=
= This would allow a logged in user to discover the password
= hash of a different user.
=
= Impact: Moderate
=
= Affects default
= configuration: When configured with tools like realmd or
= ipa-client-install
=
= Introduced with: 1.12.0
=
==============================================================================
==== DESCRIPTION ====
SSSD stores its cached data in an LDAP like local database file using libldb.
To lookup cached data LDAP search filters like
'(objectClass=user)(name=user_name)' are used. However, in
sysdb_search_user_by_upn_res(), the input is not sanitized and allows to
manipulate the search filter for cache lookups.
This would allow a logged in user to discover the password hash of a different
user.
While in the default configuration the sssd.conf parameter 'cache_credentials'
is set to 'False' it is typically switched to 'True' by tools like realmd or
ipa-client-install to support offline authentication.
To remove the only password hashes from the cache 'cache_credentials' should be
set to 'False' in all [domain/...] sections of sssd.conf. Additionally the
already stored hashes must be remove e.g. by calling
ldbedit -H /var/lib/sss/db/cache_DOMAIN-NAME.ldb
for each configured domain and removing all 'cachedPassword' attributes.
==== PATCH AVAILABILITY ====
The patch is available at:
https://pagure.io/SSSD/sssd/c/1f2662c8f97c9c0fa250055d4b6750abfc6d0835?br...
6 years, 6 months
Call for Participation: Identity and Access Management devroom @ FOSDEM 2018
by Alexander Bokovoy
Welcome to Identity and Access Management developer room at FOSDEM 2018
(Brussels, Belgium, February 3rd).
FOSDEM is a free software event that offers open source communities a place to
meet, share ideas and collaborate. It is renown for being highly developer-
oriented and brings together 8000+ participants from all over the world. It
is held in the city of Brussels (Belgium).
FOSDEM 2018 will take place during the weekend of February 3rd-4th 2018. More
details about the event can be found at http://fosdem.org/
On Saturday, February 3rd, FOSDEM will see a first-time Identity and Access
Management developer room. Devrooms are a place for development teams to meet,
discuss, hack and publicly present their project's latest improvements and
future directions.
Identity and Access Management (IAM/IdM) is a concept that touches everyone's
lives. We all have many identities and associated credentials to manage. At
work, we need to access many kinds of services every day, sometimes with
multiple identities and using different authentication methods. Those who
deploy identity infrastructure need also to deal with audit and monitoring of
user activities. Security is paramount but efficiency and ease of use matter
too!
** Call For Participation
The IAM/IdM developer room is devoted to all things Identity Management. Both
server and client side free software projects in the area of identity
management are welcomed to present their state and progress.
Presentation topics could include:
- Security: algorithms and protocols for IAM/IdM;
passwords and password alternatives
- Federated and social identity;
leveraging external identities in applications
- Audit, compliance, monitoring
- User experience, desktop integration
- Free software IAM/IdM offerings
- IAM/IdM deployment reports
and more. Don't be shy and show how your project helps to improve our lives.
** Important dates:
- 26 Nov 2017: submission deadline for talk proposals
- 15 Dec 2017: announcement of the final schedule
- 3 Feb 2018: Identity and Access Management devroom (Saturday)
Talk proposals will be reviewed by a steering committee:
- Alexander Bokovoy (Samba Team, FreeIPA // Red Hat Inc.)
- Marcus Rückert (OpenSUSE Infrastructure // SUSE LINUX GmbH)
- Jakub Hrozek (SSSD // Red Hat Inc.)
- Timo Aaltonen (Debian, Ubuntu // Canonical)
Use the FOSDEM 'pentabarf' tool to submit your proposal:
https://penta.fosdem.org/submission/FOSDEM18
- If necessary, create a Pentabarf account and activate it.
Please reuse your account from previous years if you have
already created it.
- In the "Person" section, provide First name, Last name
(in the "General" tab), Email (in the "Contact" tab)
and Bio ("Abstract" field in the "Description" tab).
- Submit a proposal by clicking on "Create event".
- Important! Select the "Identity and Access Management devroom" track
(on the "General" tab).
- Provide the title of your talk ("Event title" in the "General" tab).
- Provide a description of the subject of the talk and the
intended audience (in the "Abstract" field of the "Description" tab)
- Provide a rough outline of the talk or goals of the session (a short
list of bullet points covering topics that will be discussed) in the
"Full description" field in the "Description" tab
- Provide an expected length of your talk in the "Duration" field. Please
count at least 10 minutes of discussion into your proposal.
Suggested talk length would be 15, 20+10, 30+10, and 40+10 minutes.
** Recording of talks
The FOSDEM organizers plan to have live streaming and recording fully working,
both for remote/later viewing of talks, and so that people can watch streams
in the hallways when rooms are full. This requires speakers to consent to
being recorded and streamed. If you plan to be a speaker, please understand
that by doing so you implicitly give consent for your talk to be recorded and
streamed. The recordings will be published under the same license as all
FOSDEM content (CC-BY).
--
/ Alexander Bokovoy
6 years, 6 months
