Security update for sssd SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:2651-1 Final 1 1 2016-10-26T13:08:00Z current 2016-10-26T13:08:00Z 2016-10-26T13:08:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sssd This update for sssd fixes one security issue and three bugs. The following vulnerability was fixed: - CVE-2014-0249: Incorrect expansion of group membership when encountering a non-POSIX group. (bsc#880245) The following non-security fixes were also included: - Prevent crashes of statically linked binaries using getpwuid when sssd is used and nscd is turned off or has caching disabled. (bsc#993582) - Add logrotate configuration to prevent log files from growing too large when running with debug mode enabled. (bsc#1004220) - Order sudo rules by the same logic used by the native LDAP support from sudo. (bsc#1002973) This update was imported from the SUSE:SLE-12-SP1:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2016-10/msg00103.html E-Mail link for openSUSE-SU-2016:2651-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.1 libipa_hbac-devel-1.11.5.1-16.1 libipa_hbac0-1.11.5.1-16.1 libsss_idmap-devel-1.11.5.1-16.1 libsss_idmap0-1.11.5.1-16.1 libsss_nss_idmap-devel-1.11.5.1-16.1 libsss_nss_idmap0-1.11.5.1-16.1 libsss_sudo-1.11.5.1-16.1 python-ipa_hbac-1.11.5.1-16.1 python-sss_nss_idmap-1.11.5.1-16.1 python-sssd-config-1.11.5.1-16.1 sssd-1.11.5.1-16.1 sssd-32bit-1.11.5.1-16.1 sssd-ad-1.11.5.1-16.1 sssd-ipa-1.11.5.1-16.1 sssd-krb5-1.11.5.1-16.1 sssd-krb5-common-1.11.5.1-16.1 sssd-ldap-1.11.5.1-16.1 sssd-proxy-1.11.5.1-16.1 sssd-tools-1.11.5.1-16.1 libipa_hbac-devel-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 libipa_hbac0-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 libsss_idmap-devel-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 libsss_idmap0-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 libsss_nss_idmap-devel-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 libsss_nss_idmap0-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 libsss_sudo-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 python-ipa_hbac-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 python-sss_nss_idmap-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 python-sssd-config-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 sssd-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 sssd-32bit-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 sssd-ad-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 sssd-ipa-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 sssd-krb5-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 sssd-krb5-common-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 sssd-ldap-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 sssd-proxy-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 sssd-tools-1.11.5.1-16.1 as a component of openSUSE Leap 42.1 The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors. CVE-2014-0249 openSUSE Leap 42.1:libipa_hbac-devel-1.11.5.1-16.1 openSUSE Leap 42.1:libipa_hbac0-1.11.5.1-16.1 openSUSE Leap 42.1:libsss_idmap-devel-1.11.5.1-16.1 openSUSE Leap 42.1:libsss_idmap0-1.11.5.1-16.1 openSUSE Leap 42.1:libsss_nss_idmap-devel-1.11.5.1-16.1 openSUSE Leap 42.1:libsss_nss_idmap0-1.11.5.1-16.1 openSUSE Leap 42.1:libsss_sudo-1.11.5.1-16.1 openSUSE Leap 42.1:python-ipa_hbac-1.11.5.1-16.1 openSUSE Leap 42.1:python-sss_nss_idmap-1.11.5.1-16.1 openSUSE Leap 42.1:python-sssd-config-1.11.5.1-16.1 openSUSE Leap 42.1:sssd-1.11.5.1-16.1 openSUSE Leap 42.1:sssd-32bit-1.11.5.1-16.1 openSUSE Leap 42.1:sssd-ad-1.11.5.1-16.1 openSUSE Leap 42.1:sssd-ipa-1.11.5.1-16.1 openSUSE Leap 42.1:sssd-krb5-1.11.5.1-16.1 openSUSE Leap 42.1:sssd-krb5-common-1.11.5.1-16.1 openSUSE Leap 42.1:sssd-ldap-1.11.5.1-16.1 openSUSE Leap 42.1:sssd-proxy-1.11.5.1-16.1 openSUSE Leap 42.1:sssd-tools-1.11.5.1-16.1 low 2.4 AV:L/AC:H/Au:S/C:P/I:P/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-10/msg00103.html https://www.suse.com/security/cve/CVE-2014-0249.html CVE-2014-0249 https://bugzilla.suse.com/880245 SUSE Bug 880245