CVE-2010-0014

描述

System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting ticket (TGT); and might allow remote attackers to bypass intended access restrictions via vectors involving an arbitrary password in conjunction with a valid TGT.

如何修補 CVE-2010-0014

要修補 CVE-2010-0014,請將受影響套件升級到下列已修補版本。

• Debian/sssd—升級至 1.0.5-1 或更新版本

CVE-2010-0014 正在被利用嗎?

低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.0.5-1

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2010-0014