このsssdの更新では、次の問題が修正されます：

対応済みセキュリティ脆弱性：

fallback_homedirが空のホームディレクトリに「/」を返す問題を修正します（CVE-2019-3811）（bsc#1121759）

適切な権限でソケットを作成します（bsc#1098377、CVE-2018-10852）

その他のバグ修正と変更：logrotate構成をインストールします（bsc#1004220）

netgroupトリプルの空白を取り除きます（bsc#1087320）

Upstreamに合わせてsystemdサービスファイルを調整します

  - インタラクティブに実行し、通知するサービスタイプを変更します（bsc#1120852）

  - 非推奨の「-f」を置き換えて「--logger」を使用します

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

インストールされているsssdパッケージのバージョンによると、リモートホストにインストールされているEulerOSは次の脆弱性の影響を受けます。- ホームディレクトリを設定しないでユーザーを構成した場合にsssdが「」（空の文字列/ホームディレクトリなし）ではなく「/」（ルートディレクトリ）を返す脆弱性が、sssdに見つかりました。これは、ユーザーのファイルシステムへのアクセスをchroot()を介してホームディレクトリ内に制限するサービスに影響を与える可能性があります。（CVE-2019-3811）注意：Tenable Network Securityは、前述の記述ブロックをEulerOSセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

针对 adcli 和 sssd 的这项更新提供下列改进：修复的安全漏洞：CVE-2019-3811：修复 fallback_homedir，以便为空的主目录传回“/”(bsc#1121759) 其他修复：添加选项以对禁用子域提供者中受信任域的检查 (bsc#1125617) 在异常情况下清除 pid 文件 (bsc#1127670) 修复在 SIGHUP 后无法写入日子文件的子进程 (bsc#1127670) 在 SUSE Linux Enterprise 12 SP3 中为 sssd-ad 添加 adcli。(fate#326619、bsc#1109849) 使用 Active Directory 时，adcli 让 sssd 能够进行密码更新。请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2019:2177 公告中提及的多个漏洞的影响。

  - sssd：因为过于严格的权限而不当实现 GPO (CVE-2018-16838)

  - sssd：fallback_homedir 在密码文件中为空的主目录返回 '/' (CVE-2019-3811)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

下列程序包已升级到更高的上游版本：sssd (1.16.4)。安全修复：- sssd：fallback_homedir 在密码文件中为空的主目录返回 '/' (CVE-2019-3811) - sssd：因为过于严格的权限而不当实现 GPO (CVE-2018-16838)

运行版本 CORE 5.04 / MAIN 5.04 的远程 NewStart CGSL 主机安装有受多个漏洞影响的 sssd 程序包：- 在 sssd 中发现漏洞。若用户配置为无主目录组，sssd 会返回 “/”（root 目录）而非 ''（空字符串/无主目录）。这可能影响通过 chroot() 等将用户文件系统访问限制在其主目录的服务。2.1 之前的所有版本均容易受到影响。(CVE-2019-3811) - 在 sssd 群组策略对象实现中发现一个缺陷。当由于服务器端的权限设置过严导致 SSSD 无法读取 GPO 时，SSSD 将允许所有经过身份验证的用户登录，而非拒绝访问。(CVE-2018-16838) 请注意，Nessus 并未针对此问题进行测试，而仅依赖应用程序自我报告的版本号。

远程 Ubuntu 18.04 LTS / 20.04 LTS / 21.04 主机上安装的程序包受到 USN-5067-1 公告中提及的多个漏洞的影响。

  - 在 sssd 群组策略对象实现中发现一个缺陷。当由于服务器端的权限设置过严导致 SSSD 无法读取 GPO 时，SSSD 将允许所有经过身份验证的用户登录，而非拒绝访问。(CVE-2018-16838)

  - sudo 用来联系 SSSD 并读取 SSSD 中可用 sudo 规则的 UNIX 管道权限过于宽泛，这意味着能够使用 sudo 和 SSSD 所用的相同原始协议发送消息的任何用户，都可以读取适用于任何用户的 sudo 规则。这会影响低于 1.16.3 的 SSSD 版本。
    (CVE-2018-10852)

  - 在 sssd 中发现漏洞。若用户配置为无主目录组，sssd 会返回 “/”（root 目录）而非 ''（空字符串/无主目录）。这会影响限制用户的文件系统通过 chroot() 等在主目录访问的服务。2.1 之前的所有版本均容易受到影响。(CVE-2019-3811)

  - 在 SSSD 中发现一个缺陷，其中 sssctl 命令容易受到通过 logs-fetch 和 cache-expire 子命令进行的 shell 命令注入影响。此缺陷允许攻击者诱骗 root 用户运行特别构建的 sssctl 命令，例如通过 sudo 获取 root 访问权限。此漏洞最大的威胁在于机密性、完整性，以及系统可用性。(CVE-2021-3621)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

This update for adcli and sssd provides the following improvement :

Security vulnerability fixed :

CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759)

Other fixes: Add an option to disable checking for trusted domains in the subdomains provider (bsc#1125617)

Clear pid file in corner cases (bsc#1127670)

Fix child unable to write to log file after SIGHUP (bsc#1127670)

Include adcli in SUSE Linux Enterprise 12 SP3 for sssd-ad.
(fate#326619, bsc#1109849)

The adcli enables sssd to do password renewal when using Active Directory.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for adcli and sssd provides the following improvement :

Security vulnerability fixed :

  - CVE-2019-3811: Fix fallback_homedir returning '/' for     empty home directories (bsc#1121759)

Other fixes :

  - Add an option to disable checking for trusted domains in     the subdomains provider (bsc#1125617)

  - Clear pid file in corner cases (bsc#1127670)

  - Fix child unable to write to log file after SIGHUP     (bsc#1127670)

  - Include adcli in SUSE Linux Enterprise 12 SP3 for     sssd-ad. (fate#326619, bsc#1109849)

The adcli enables sssd to do password renewal when using Active Directory. This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2177 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    The following packages have been upgraded to a later upstream version: sssd (1.16.4). (BZ#1658994)

    Security Fix(es):

    * sssd: fallback_homedir returns '/' for empty home directories in passwd file (CVE-2019-3811)

    * sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The following packages have been upgraded to a later upstream version:
sssd (1.16.4).

Security Fix(es) :

  - sssd: fallback_homedir returns '/' for empty home     directories in passwd file (CVE-2019-3811)

  - sssd: improper implementation of GPOs due to too     restrictive permissions (CVE-2018-16838)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sssd packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in sssd. If a user was     configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string     / no home directory). This could impact services that     restrict the user's filesystem access to within their     home directory through chroot() etc. All versions before     2.1 are vulnerable. (CVE-2019-3811)

  - A flaw was found in sssd Group Policy Objects     implementation. When the GPO is not readable by SSSD due     to a too strict permission settings on the server side,     SSSD will allow all authenticated users to login instead     of denying access. (CVE-2018-16838)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has sssd packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in sssd. If a user was     configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string     / no home directory). This could impact services that     restrict the user's filesystem access to within their     home directory through chroot() etc. All versions before     2.1 are vulnerable. (CVE-2019-3811)

  - A flaw was found in sssd Group Policy Objects     implementation. When the GPO is not readable by SSSD due     to a too strict permission settings on the server side,     SSSD will allow all authenticated users to login instead     of denying access. (CVE-2018-16838)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5067-1 advisory.

    Jakub Hrozek discovered that SSSD incorrectly handled file permissions. A local attacker could possibly     use this issue to read the sudo rules available for any user. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2018-10852)

    It was discovered that SSSD incorrectly handled Group Policy Objects. When SSSD is configured with too     strict permissions causing the GPO to not be readable, SSSD will allow all authenticated users to login     instead of being denied, contrary to expectations. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2018-16838)

    It was discovered that SSSD incorrectly handled users with no home directory set. When no home directory     was set, SSSD would return the root directory instead of an empty string, possibly bypassing security     measures. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3811)

    Cedric Buissart discovered that SSSD incorrectly handled the sssctl command. In certain environments, a     local user could use this issue to execute arbitrary commands and possibly escalate privileges.
    (CVE-2021-3621)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
122665	SUSE SLED12 / SLES12セキュリティ更新プログラム：sssd（SUSE-SU-2019:0556-1）	Nessus	SuSE Local Security Checks	2019/3/7	2024/6/17	high
126287	EulerOS 2.0 SP8：sssd（EulerOS-SA-2019-1660）	Nessus	Huawei Local Security Checks	2019/6/27	2024/5/14	medium
126296	EulerOS 2.0 SP5：sssd（EulerOS-SA-2019-1669）	Nessus	Huawei Local Security Checks	2019/6/27	2024/5/14	medium
123549	SUSE SLED12 / SLES12 安全更新：针对 adcli、sssd 的建议更新 (SUSE-SU-2019:0805-1)	Nessus	SuSE Local Security Checks	2019/4/1	2024/6/6	medium
127691	RHEL 7：sssd (RHSA-2019:2177)	Nessus	Red Hat Local Security Checks	2019/8/12	2024/11/6	medium
128264	Scientific Linux 安全更新：SL7.x x86_64 上的 sssd	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	medium
129890	NewStart CGSL CORE 5.04 / MAIN 5.04：sssd 多个漏洞 (NS-SA-2019-0195)	Nessus	NewStart CGSL Local Security Checks	2019/10/15	2021/1/14	medium
153144	Ubuntu 18.04 LTS / 20.04 LTS：SSSD 漏洞 (USN-5067-1)	Nessus	Ubuntu Local Security Checks	2021/9/8	2025/9/3	high
123549	SUSE SLED12 / SLES12 Security Update : Recommended update for adcli, sssd (SUSE-SU-2019:0805-1)	Nessus	SuSE Local Security Checks	2019/4/1	2024/6/6	medium
123991	openSUSE Security Update : sssd (openSUSE-2019-1174)	Nessus	SuSE Local Security Checks	2019/4/11	2024/6/3	medium
127691	RHEL 7 : sssd (RHSA-2019:2177)	Nessus	Red Hat Local Security Checks	2019/8/12	2024/11/6	medium
128264	Scientific Linux Security Update : sssd on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	medium
129890	NewStart CGSL CORE 5.04 / MAIN 5.04 : sssd Multiple Vulnerabilities (NS-SA-2019-0195)	Nessus	NewStart CGSL Local Security Checks	2019/10/15	2021/1/14	medium
132447	NewStart CGSL CORE 5.05 / MAIN 5.05 : sssd Multiple Vulnerabilities (NS-SA-2019-0241)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2021/1/14	medium
153144	Ubuntu 18.04 LTS / 20.04 LTS : SSSD vulnerabilities (USN-5067-1)	Nessus	Ubuntu Local Security Checks	2021/9/8	2025/9/3	high

偵測

搜尋 Plugin

high

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

high