Description
System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sssd | 1.8.4-2 | — |
| Debian 13 | sssd | 1.8.4-2 | — |
| Debian 12 | sssd | 1.8.4-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | sssd +10 | 1.9.2-82.el6 | RHSA-2013:0508 |
| RHEL 5 | sssd +5 | 1.5.1-70.el5 | RHSA-2013:1319 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sssd | 1.14.2-3.1 | openSUSE-SU-2024:10427-1 |
Advisories 3
- RHSA-2013:0508 Red Hat Security Advisory: sssd security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:1319 Red Hat Security Advisory: sssd security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10427-1 libipa_hbac-devel-1.14.2-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4
- 51928 third-party-advisory
- FEDORA-2013-1795 vendor-advisory
- RHSA-2013:0508 vendor-advisory
- http://git.fedorahosted.org/cgit/sssd.git/commit/?id=94cbf1cfb0f88c967f1fb0a4cf23723148868e4a
- RHSA-2013:1319 vendor-advisory
- http://git.fedorahosted.org/cgit/sssd.git/commit/?id=020bf88fd1c5bdac8fc671b37c7118f5378c7047
- 52315 third-party-advisory
- https://fedorahosted.org/sssd/ticket/1782
- 57539 vdb-entry
- http://git.fedorahosted.org/cgit/sssd.git/commit/?id=3843b284cd3e8f88327772ebebc7249990fd87b9
- https://bugzilla.redhat.com/show_bug.cgi?id=884254
- http://git.fedorahosted.org/cgit/sssd.git/commit/?id=e864d914a44a37016736554e9257c06b18c57d37
- FEDORA-2013-1826 vendor-advisory