CVE-2013-0287: sssd simple access provider flaw prevents intended ACL use when client to an AD provider

[Vincent Danen <vdanen () redhat com>]

This was posted to the linux-distros last week and as per the policy I'm
posting it here now.


Kaushik Banerjee discovered that SSSD's "simple" access provider did not
work as expected when SSSD is configured as an Active Directory client
when using the new (as of version 1.9.0) Active Directory provider.
During the PAM account phase, SSSD may not not know the group name of a
group that the user is a member of, but only the Windows Security
Identifier.  Because the group name is not known, the simple_deny_groups
option does not work at all, and will always permit access; if any
groups are noted in simple_deny_groups, all groups are permitted access.
In addition, if any groups are noted in simple_allow_groups, access is
always denied to everyone.

By default, the configuration will allow all users to login (both
simple_deny_groups and simple_allow_groups are empty).

The Active Directory provider was introduced in version 1.9.0; earlier
versions of SSSD are not vulnerable to this flaw.


Acknowledgements:

This issue was discovered by Kaushik Banerjee of Red Hat.

References:

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0287

--
Vincent Danen / Red Hat Security Response Team

Attachment: _bin
Description: