Information disclosure in Red Hat Enterprise Linux for x86_64 - CVE-2017-7488
Published: August 2, 2017
Vulnerability identifier: #VU7662
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-7488
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Red Hat Inc.
Affected software:
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64
Detailed vulnerability description
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper configuration of the System Security Services Daemon (SSSD) by the authconfig feature. A remote attacker can use SSSD to authenticate against remote server, conduct a timing attack and read arbitrary files that may be used to conduct further attacks.
Successful exploitation of the vulnerability results in information disclosure.
The weakness exists due to improper configuration of the System Security Services Daemon (SSSD) by the authconfig feature. A remote attacker can use SSSD to authenticate against remote server, conduct a timing attack and read arbitrary files that may be used to conduct further attacks.
Successful exploitation of the vulnerability results in information disclosure.
How to mitigate CVE-2017-7488
Install update from vendor's website.