RHBA-2013:1680 - Bug Fix Advisory

Topic

Updated sssd packages that fix a number of bugs and add two enhancements are now
available for Red Hat Enterprise Linux 6.

Description

The System Security Services Daemon (SSSD) provides a set of daemons to manage
access to remote directories and authentication mechanisms. It provides the Name
Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces
toward the system and a pluggable back-end system to connect to multiple
different account sources.

These updated sssd packages include numerous bug fixes and enhancements. Space
precludes documenting all of these changes in this advisory. Users are directed
to the Red Hat Enterprise Linux 6.5 Technical Notes for information on the most
significant of these changes:

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Technical_Notes/sssd.html#RHBA-2013-1680

Users of sssd are advised to upgrade to these updated packages, which fix these
bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 891647 - clarify the disadvantages of enumeration in sssd.conf
• BZ - 906398 - sssd_be crashes sometimes
• BZ - 911329 - pwd_expiration_warning has wrong default for Kerberos
• BZ - 914433 - sssd pam write_selinux_login_file creating the temp file for SELinux data failed
• BZ - 918394 - sssd etas 99% CPU and runs out of file descriptors when clearing cache
• BZ - 924113 - man sssd-sudo has wrong title
• BZ - 924397 - document what does access_provider=ad do
• BZ - 928797 - cyclic group memberships may not work depending on order of operations
• BZ - 950874 - Simple access control always denies uppercased users in case insensitive domain
• BZ - 951086 - sssd segfaults (sssd_be & sssd_pam) with use-after-free error if the back end request takes too long
• BZ - 954275 - sssd fails connect to IPA server during boot when spanning tree is enabled in network router.
• BZ - 961356 - SUDO is not working for users from trusted AD domain
• BZ - 963235 - sssd_be crashing with nested ldap groups
• BZ - 966757 - SSSD failover doesn't work if the first DNS server in resolv.conf is unavailable
• BZ - 967636 - SSSD frequently fails to return automount maps from LDAP
• BZ - 970519 - [RFE] Add support for suppressing group members
• BZ - 971435 - Enhance sssd init script so that it would source a configuration
• BZ - 978966 - sudoHost mismatch response is incorrect sometimes
• BZ - 978994 - SSSD filter out ldap user/group if uid/gid is zero
• BZ - 979046 - sssd_be goes to 99% CPU and causes significant login delays when client is under load
• BZ - 983028 - passwd returns "Authentication token manipulation error" when entering wrong current password
• BZ - 986379 - sss_cache -N/-n should invalidate the hash table in sssd_nss
• BZ - 987456 - RHEL6 sssd upgrade restorecon workaround for /var/lib/sss/mc context
• BZ - 987479 - libsss_sudo should depend on sudo package with sssd support
• BZ - 988381 - clarify the disadvantages of enumeration in sssd.conf
• BZ - 1002161 - large number of sudo rules results in error - Unable to create response: Invalid argument

CVEs

(none)

References

• https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Technical_Notes/sssd.html#RHBA-2013-1680