#VU17121 Improper access control in SSSD - CVE-2019-3811

Vulnerability identifier: #VU17121

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-3811

CWE-ID: CWE-284

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
SSSD
Web applications / Remote management & hosting panels

Vendor: SSSD

Description

The vulnerability allows an adjacent authenticated attacker to bypass security restrictions.

The vulnerability exists due to the return of '/' (the root directory) instead of '' (the empty string / no home directory) if a user was configured with no home directory set. An adjacent attacker can bypass services that restrict the user's filesystem access to within their home directory through chroot().

Mitigation
Update to version 2.1.

Vulnerable software versions

SSSD: 1.13.0 - 2.0.0

---

External links
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3811
https://github.com/SSSD/sssd/pull/703

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.