Information disclosure in Red Hat Enterprise Linux for x86_64 - CVE-2017-7488
Published: August 2, 2017
Vulnerability identifier: #VU7662
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7488
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper configuration of the System Security Services Daemon (SSSD) by the authconfig feature. A remote attacker can use SSSD to authenticate against remote server, conduct a timing attack and read arbitrary files that may be used to conduct further attacks.
Successful exploitation of the vulnerability results in information disclosure.
The weakness exists due to improper configuration of the System Security Services Daemon (SSSD) by the authconfig feature. A remote attacker can use SSSD to authenticate against remote server, conduct a timing attack and read arbitrary files that may be used to conduct further attacks.
Successful exploitation of the vulnerability results in information disclosure.
Affected software
Red Hat Enterprise Linux for x86_64
Amazon Linux AMI
Fedora
authconfig
Amazon Linux AMI
Fedora
authconfig
How to mitigate CVE-2017-7488
Install update from vendor's website.
authconfig - update to 7.0.1-1.fc26