CVE-2013-0219

SSSD < 1.9.4 - Arbitrary File Manipulation via Symlink Attack

Title source: llm
STIX 2.1

Description

System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.

References (14)

Core 14
Core References
Third Party Advisory x_refsource_confirm
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/51928
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098434.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0508.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1319.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/52315
Various Sources x_refsource_confirm
https://fedorahosted.org/sssd/ticket/1782
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/57539
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=884254
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098613.html

Scores

EPSS 0.0037
EPSS Percentile 29.1%

Details

CWE
CWE-264
Status published
Products (50)
fedoraproject/sssd 0.2.1
fedoraproject/sssd 0.3.0
fedoraproject/sssd 0.3.1
fedoraproject/sssd 0.3.2
fedoraproject/sssd 0.3.3
fedoraproject/sssd 0.4.0
fedoraproject/sssd 0.4.1
fedoraproject/sssd 0.5.0
fedoraproject/sssd 0.6.0
fedoraproject/sssd 0.6.1
... and 40 more
Published Feb 24, 2013
Tracked Since Feb 18, 2026