CVE-2010-2940

The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pam_authenticate via an empty password.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.1 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:N/C:P/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
VendorProductVersion
fedoraprojectsssd
1.3.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
sssd
bullseye
2.4.1-2
fixed
bookworm
2.8.2-4
fixed
sid
2.9.5-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
sssd
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
not-affected
natty
not-affected
maverick
not-affected
lucid
ignored
karmic
ignored
jaunty
dne
hardy
dne
dapper
dne
Common Weakness Enumeration
References
http://secunia.com/advisories/41159
https://bugzilla.redhat.com/show_bug.cgi?id=625189
https://exchange.xforce.ibmcloud.com/vulnerabilities/61399
http://secunia.com/advisories/41159
https://bugzilla.redhat.com/show_bug.cgi?id=625189
https://exchange.xforce.ibmcloud.com/vulnerabilities/61399