Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2010-0014

System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting ticket (TGT); and might allow remote attackers to bypass intended access restrictions via vectors involving an arbitrary password in conjunction with a valid TGT.

Published

2010-01-14T18:30:00.513

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 3.7 (LOW)

CVSSv2 Vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

  • Access Vector: LOCAL
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

1.9

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-287
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application fedoraproject sssd ≤ 1.0.0 Yes
Application fedoraproject sssd 0.2.1 Yes
Application fedoraproject sssd 0.3.0 Yes
Application fedoraproject sssd 0.3.1 Yes
Application fedoraproject sssd 0.3.2 Yes
Application fedoraproject sssd 0.3.3 Yes
Application fedoraproject sssd 0.4.0 Yes
Application fedoraproject sssd 0.4.1 Yes
Application fedoraproject sssd 0.5.0 Yes
Application fedoraproject sssd 0.6.0 Yes
Application fedoraproject sssd 0.6.1 Yes
Application fedoraproject sssd 0.7.0 Yes
Application fedoraproject sssd 0.7.1 Yes
Application fedoraproject sssd 0.99.0 Yes
Application fedoraproject sssd 0.99.1 Yes
References