Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

SSSD PAM module can be crashed by a local user

CVE-2010-4341 · published 15 years ago
Summary

The SSSD authentication component that handles PAM requests in versions 1.3, 1.4, and 1.5 can be forced into an endless loop or forced to stop working if a local user sends a specially crafted message. This can prevent users from logging in and may cause the service to restart repeatedly. Apply the vendor's update or patch and restart the SSSD service to stop the issue.

What to do
  • Update debian sssd to version 1.2.1-4.1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian sssd < 1.2.1-4.1
Fix: upgrade to 1.2.1-4.1
Debian:13 debian sssd < 1.2.1-4.1
Fix: upgrade to 1.2.1-4.1
– fedorahosted sssd 1.4.0
1.4.1
cpe:2.3:a:fedorahosted:sssd:1.4.0:*:*:*:*:*:*:*
– fedoraproject sssd 1.3.0
1.5.0
cpe:2.3:a:fedoraproject:sssd:1.3.0:*:*:*:*:*:*:*
Original advisory text
The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service (infinite loop, crash, and log...
The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service (infinite loop, crash, and login prevention) via a crafted packet.
References
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published25 Jan 2011
Updated4 Nov 2026
First seen4 Sep 2026
Sources
DEBIAN-CVE-2010-4341 · OSV
CVE-2010-4341 · NVD
Track software like this
Free during beta