Description
The krb5_save_ccname_done function in providers/krb5/krb5_auth.c in System Security Services Daemon (SSSD) 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by listing the /tmp directory to obtain the pathname.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sssd | 1.14.2-3.1 | openSUSE-SU-2024:10427-1 |
Advisories 1
- openSUSE-SU-2024:10427-1 libipa_hbac-devel-1.14.2-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=700867
- https://fedorahosted.org/sssd/ticket/856
- [oss-security] 20110429 vulnerability in sssd 1.5.0+ (CVE-2011-1758) mailing-list
- FEDORA-2011-5815 vendor-advisory
- FEDORA-2011-6279 vendor-advisory
- [sssd-devel] 20110429 SSSD Security Release 1.5.7 mailing-list
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.7
- http://git.fedorahosted.org/git/?p=sssd.git%3Ba=commit%3Bh=fffdae81651b460f3d2c119c56d5caa09b4de42a
- https://bugzilla.redhat.com/show_bug.cgi?id=700891