CVE-2013-0220
Fixed in a distro release EPSS 3%
The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet.
Products: fedoraproject sssd
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | sssd | 1.8.4-2 |
| Debian 13 | sssd | 1.8.4-2 |
| Red Hat Enterprise Linux 6 | libipa_hbac | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | libipa_hbac-devel | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | libipa_hbac-python | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | libsss_autofs | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | libsss_idmap | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | libsss_idmap-devel | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | libsss_sudo | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | libsss_sudo-devel | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | sssd | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | sssd-client | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | sssd-debuginfo | 0:1.9.2-82.el6 |
| Red Hat Enterprise Linux 6 | sssd-tools | 0:1.9.2-82.el6 |
| openSUSE Tumbleweed | sssd | 1.14.2-3.1 |