RHBA-2013:1271 - Bug Fix Advisory

Topic

Updated sssd packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

The System Security Services Daemon (SSSD) provides a set of daemons to manage
access to remote directories and authentication mechanisms. It provides the Name
Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces
toward the system and a pluggable back-end system to connect to multiple
different account sources.

This update fixes the following bugs:

• In case the processing of an LDAP request took longer than the client timeout

(60 seconds by default), upon completing the request, the PAM client could have
accessed memory that was previously freed due to the client timeout being
reached. As a result, the sssd_pam process terminated unexpectedly with a
segmentation fault. With this update, SSSD ignores an LDAP request result when
it detects that the set timeout of this request has been reached. The sssd_pam
process no longer crashes in the aforementioned scenario. (BZ#986824)

• In case SSSD could not save a sudo rule to the cache, it returned an error and

stopped processing the rest of the sudo rules. Consequently, none of the rules
from the related provider were saved because the error canceled the entire
transaction. With this update, in case a sudo rule cannot be saved to the cache,
a message is appended to the logs and the rules is skipped; processing of the
remaining rules continues and works as expected. As a result, all but the
defective sudo rule are saved to the cache. (BZ#996020)

• If a large amount of sudo rules with a combined size that exceeded 265 KB was

configured on the system, due to the way the sss_packet_grow() function computed
the total length of a response packet, SSSD failed with a "Unable to create
response: Invalid argument" error message. With this update, the
sss_package_grow() function code has been fixed to properly compute the response
packet length, and SSSD no longer fails in the aforementioned scenario.
(BZ#1003567)

Users of sssd are advised to upgrade to these updated packages, which fix these
bugs.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.4 i386
• Red Hat Enterprise Linux Server - AUS 6.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.4 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.4 x86_64
• Red Hat Gluster Storage Server for On-premise 2.1 x86_64
• Red Hat Storage for Public Cloud (via RHUI) 2.1 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.4 i386
• Red Hat Enterprise Linux EUS Compute Node 6.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 1003567 - large number of sudo rules results in error - Unable to create response: Invalid argument

CVEs

(none)

References

(none)