SUSE update for sssd

1) Improper privilege management

EUVDB-ID: #VU117689

Risk: Medium

CVSSv4.0: 2.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U/U:Green]

CVE-ID: CVE-2025-11561

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a remote user to bypass authorization checks.

The vulnerability exists due to improper privilege management within the Active Directory integration feature. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.

Mitigation

Update the affected package sssd to the latest version.

Vulnerable software versions

SUSE Manager Server 4.3: LTS

SUSE Manager Retail Branch Server 4.3: LTS

SUSE Manager Proxy 4.3: LTS

SUSE Linux Enterprise Server 15 SP4: LTSS

SUSE Linux Enterprise High Performance Computing LTSS 15: SP4

SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4

SUSE Linux Enterprise Micro for Rancher: 5.3 - 5.4

SUSE Linux Enterprise Micro: 5.3 - 5.4

SUSE Linux Enterprise Server for SAP Applications 15: SP4

SUSE Linux Enterprise Server 15: SP4

SUSE Linux Enterprise High Performance Computing 15: SP4

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

openSUSE Leap: 15.4

sssd-common-64bit: before 2.5.2-150400.4.40.1

sssd-common-64bit-debuginfo: before 2.5.2-150400.4.40.1

libnfsidmap-sss-debuginfo: before 2.5.2-150400.4.40.1

python3-ipa_hbac-debuginfo: before 2.5.2-150400.4.40.1

python3-sss_nss_idmap: before 2.5.2-150400.4.40.1

python3-sss-murmur: before 2.5.2-150400.4.40.1

python3-sss_nss_idmap-debuginfo: before 2.5.2-150400.4.40.1

python3-sss-murmur-debuginfo: before 2.5.2-150400.4.40.1

libnfsidmap-sss: before 2.5.2-150400.4.40.1

python3-ipa_hbac: before 2.5.2-150400.4.40.1

python3-sssd-config-debuginfo: before 2.5.2-150400.4.40.1

sssd-common-32bit: before 2.5.2-150400.4.40.1

libsss_nss_idmap0: before 2.5.2-150400.4.40.1

libsss_certmap0-debuginfo: before 2.5.2-150400.4.40.1

sssd-kcm: before 2.5.2-150400.4.40.1

sssd-common-32bit-debuginfo: before 2.5.2-150400.4.40.1

sssd-krb5-debuginfo: before 2.5.2-150400.4.40.1

sssd-krb5-common-debuginfo: before 2.5.2-150400.4.40.1

sssd-common: before 2.5.2-150400.4.40.1

sssd-debugsource: before 2.5.2-150400.4.40.1

sssd: before 2.5.2-150400.4.40.1

libsss_idmap0-debuginfo: before 2.5.2-150400.4.40.1

libsss_simpleifp0-debuginfo: before 2.5.2-150400.4.40.1

libsss_simpleifp0: before 2.5.2-150400.4.40.1

libipa_hbac0: before 2.5.2-150400.4.40.1

libsss_certmap0: before 2.5.2-150400.4.40.1

sssd-ldap: before 2.5.2-150400.4.40.1

sssd-ipa-debuginfo: before 2.5.2-150400.4.40.1

sssd-ad: before 2.5.2-150400.4.40.1

libsss_nss_idmap-devel: before 2.5.2-150400.4.40.1

sssd-dbus-debuginfo: before 2.5.2-150400.4.40.1

python3-sssd-config: before 2.5.2-150400.4.40.1

libsss_certmap-devel: before 2.5.2-150400.4.40.1

sssd-common-debuginfo: before 2.5.2-150400.4.40.1

sssd-krb5-common: before 2.5.2-150400.4.40.1

libipa_hbac0-debuginfo: before 2.5.2-150400.4.40.1

sssd-dbus: before 2.5.2-150400.4.40.1

libsss_simpleifp-devel: before 2.5.2-150400.4.40.1

sssd-winbind-idmap-debuginfo: before 2.5.2-150400.4.40.1

sssd-ad-debuginfo: before 2.5.2-150400.4.40.1

sssd-kcm-debuginfo: before 2.5.2-150400.4.40.1

libsss_idmap-devel: before 2.5.2-150400.4.40.1

sssd-tools: before 2.5.2-150400.4.40.1

sssd-tools-debuginfo: before 2.5.2-150400.4.40.1

sssd-ipa: before 2.5.2-150400.4.40.1

sssd-krb5: before 2.5.2-150400.4.40.1

sssd-winbind-idmap: before 2.5.2-150400.4.40.1

sssd-proxy: before 2.5.2-150400.4.40.1

sssd-proxy-debuginfo: before 2.5.2-150400.4.40.1

libipa_hbac-devel: before 2.5.2-150400.4.40.1

libsss_idmap0: before 2.5.2-150400.4.40.1

libsss_nss_idmap0-debuginfo: before 2.5.2-150400.4.40.1

sssd-ldap-debuginfo: before 2.5.2-150400.4.40.1

CPE2.3

• cpe:2.3:o:suse:suse_manager_server_4_3:LTS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server_4_3:LTS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy_4_3:LTS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_micro_for_rancher:5.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_micro_for_rancher:5.4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_micro:5.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_micro:5.4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.4:*:*:*:*:*:*:*
• cpe:2.3:a:suse:sssd-common-64bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-common-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libnfsidmap-sss-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:python3-ipa_hbac-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:python3-sss_nss_idmap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:python3-sss-murmur:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:python3-sss_nss_idmap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:python3-sss-murmur-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libnfsidmap-sss:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:python3-ipa_hbac:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:python3-sssd-config-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-common-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_nss_idmap0:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_certmap0-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-kcm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-common-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-krb5-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-krb5-common-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-common:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_idmap0-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_simpleifp0-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_simpleifp0:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libipa_hbac0:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_certmap0:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-ipa-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-ad:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_nss_idmap-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-dbus-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:python3-sssd-config:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_certmap-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-common-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-krb5-common:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libipa_hbac0-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-dbus:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_simpleifp-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-winbind-idmap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-ad-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-kcm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_idmap-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-tools:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-tools-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-ipa:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-krb5:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-winbind-idmap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-proxy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-proxy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libipa_hbac-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_idmap0:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libsss_nss_idmap0-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:sssd-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2025/suse-su-20254181-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.