CVE-2015-5292

Published: Oct 29, 2015Modified: May 6, 2026

6.8

Vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Exploitability: 8.0 / Impact: 6.9

Source: NVD

Description

Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication.

Affected (17)

Products: Fedoraproject: Sssd

1 product

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Sssd	Version 1.10.0
Fedoraproject Sssd	Version 1.10.1
Fedoraproject Sssd	Version 1.11.0
Fedoraproject Sssd	Version 1.11.1
Fedoraproject Sssd	Version 1.11.2
Fedoraproject Sssd	Version 1.11.3
Fedoraproject Sssd	Version 1.11.4
Fedoraproject Sssd	Version 1.11.5
Fedoraproject Sssd	Version 1.11.6
Fedoraproject Sssd	Version 1.11.7
Fedoraproject Sssd	Version 1.12.0
Fedoraproject Sssd	Version 1.12.1
Fedoraproject Sssd	Version 1.12.2
Fedoraproject Sssd	Version 1.12.3
Fedoraproject Sssd	Version 1.12.4
Fedoraproject Sssd	Version 1.12.5
Fedoraproject Sssd	Version 1.13.0

Related CWEs

References (26)

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169110.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169597.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169613.html

Source: secalert@redhat.com

http://permalink.gmane.org/gmane.linux.redhat.sssd.user/3422

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2015-2019.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-2355.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/77529

Source: secalert@redhat.com

http://www.securitytracker.com/id/1034038

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1267580

Source: secalert@redhat.com

https://fedorahosted.org/sssd/attachment/ticket/2803/0001-Fix-memory-leak-in-sssdpac_verify.patch

Source: secalert@redhat.com

https://fedorahosted.org/sssd/ticket/2803

Source: secalert@redhat.com

https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.1

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169110.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169597.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169613.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://permalink.gmane.org/gmane.linux.redhat.sssd.user/3422

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2015-2019.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2015-2355.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/77529

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1034038

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1267580

Source: af854a3a-2127-422b-91ae-364da2661108

https://fedorahosted.org/sssd/attachment/ticket/2803/0001-Fix-memory-leak-in-sssdpac_verify.patch

Source: af854a3a-2127-422b-91ae-364da2661108

https://fedorahosted.org/sssd/ticket/2803

Source: af854a3a-2127-422b-91ae-364da2661108

https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.1

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.