Vulnerability Intelligence Report
CVE-2009-2410
The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password, over an ssh connection.
No Active Exploit Signals
CVSS Base Score
7.5
HIGH
EPSS Probability:1.98%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| fedorahosted | sssd | 0.4.1 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.979%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Red Hat, Inc. · Vendor · USA |
| Reserved | 2009-07-09T00:00:00 |
| Published | 2009-07-30T18:00:00 |
| Patch Date | 2009-07-29 |
| Last Updated | 2024-08-07T05:52:14 |
Community Chatter & Buzz