Re: CVS-Request: realmd code execution/auth bypass

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Upstream has opened two bugs for issues in realmd

This initial response has a CVE ID only for the second one.

> could lead to remote attackers logging into the local system
> by placing an evil AD server in the LAN
> https://bugs.freedesktop.org/show_bug.cgi?id=89205

Is upstream planning to announce this as a vulnerability fix? Although
the old behavior was unsafe if there was any possibility of an
untrusted device on the LAN, it appears that the old behavior had been
intentional. For example, the old behavior may have been chosen as a
security/convenience tradeoff. This example might be applicable:

  https://fedoraproject.org/wiki/QA:Testcase_realmd_join_automatic


> could lead to remote attackers logging into the local system by
> offering \r in LDAP responses that are treated by sssd and winbind as
> newline separator; therefore allowing to smuggle options into the
> config files used for startup

> https://bugs.freedesktop.org/show_bug.cgi?id=89207

> No data that was retrieved before join ... should be used when
> configuring sssd.conf and/or smb.conf.

Use CVE-2015-2704.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJVExugAAoJEKllVAevmvmsjMkIAJ50zsMP++L4lIXkp7U004Yf
u6+e0GUl9EHTAhbF3vT8XMqcpPN3EKmG9TFMTBQUQ1NhofQ3WhZsvXnbFV2nsDz1
e7SC+gk21IejoRbCxZjgLKLYv3WaPz46Lzfd61UjgMAxCOvx8c0QvmrF1tSoS/8h
PCU1prMYhEUdTOdlVU0TQ73FKVMyjJl5KyiVG3WmLwHxloUsYnJKCGLByu8oiG7B
BSafuVQUPKp3EROUBqGubLKjojGWv48Jp2D4EAJWVnuB2gwqab1Vzvrr7uOiVYNZ
jtjkzoH9r6BK1DiWE7MGQFlvDTp1XY5MClYnq7dLC0RKRJtXy05UeFFxYvwsjsI=
=QaAk
-----END PGP SIGNATURE-----