RHBA-2014:1375 - Bug Fix Advisory

Topic

Updated sssd packages that fix numerous bugs and add various enhancements are
now available for Red Hat Enterprise Linux 6.

Description

The System Security Services Daemon (SSSD) provides a set of daemons to manage
access to remote directories and authentication mechanisms. It provides the Name
Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces
toward the system and a pluggable back-end system to connect to multiple
different account sources.

These updated sssd packages include numerous bug fixes and enhancements. Space
precludes documenting all of these changes in this advisory. Users are directed
to the Red Hat Enterprise Linux 6.6 Technical Notes for information on the most
significant of these changes:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.6_Technical_Notes/sssd.html#RHBA-2014-1375

Users of sssd are advised to upgrade to these updated packages, which fix these
bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 990143 - Filter out inappropriate multicast and subnet broadcast addresses from dynamic DNS update
• BZ - 1007381 - proxy provider: id lookup shows "Memory buffer error" in domain log
• BZ - 1009829 - Document that server side password policies always takes precedence
• BZ - 1016991 - refresh_expired_interval man page doc is not clear
• BZ - 1019285 - sssd_be crashes sometime when installing ipa-client
• BZ - 1020905 - Creating system accounts on a IdM client takes up to 10 minutes when AD trust is configured in the IdM.
• BZ - 1028422 - sssd can't retrieve auto.master when using the "default_domain_suffix" option in
• BZ - 1031807 - sssd_be segfaults when using the AD group matching ldap option.
• BZ - 1038098 - sssd_nss grows memory footprint when netgroups are requested
• BZ - 1071823 - sssd_be[1507]: segfault at 8 ip 000000000040f68c sp 00007fff22d76f30 error 4 in sssd_be[400000+8c000]
• BZ - 1074014 - Double OK when starting the service
• BZ - 1086264 - sssd hangs on restart and sssd_be consumes 100% cpu on s390x and ppc64 archs
• BZ - 1092766 - Simple access fails to look up primary group when using sssd-ad until running the id command.
• BZ - 1102874 - RHEL6.5 sssd_be crash when debug_level 3 or higher
• BZ - 1109188 - dereferencing control failure against openldap server
• BZ - 1110226 - Requests queued during transition from offline to online mode
• BZ - 1110369 - sssd is started before messagebus, making sssd-ifp fail
• BZ - 1111528 - Expired shadow policy user(shadowLastChange=0) is not prompted for password change
• BZ - 1116010 - Enable ad_compat sasl option
• BZ - 1118336 - sudo: invalid sudoHost filter with asterisk
• BZ - 1118541 - Floating point exception using ldap
• BZ - 1120040 - sssd 1.11.6-3.el6 fails to install
• BZ - 1120508 - tokengroups do not work with id_provider=ldap
• BZ - 1122158 - ad: group membership is empty when id mapping is off and tokengroups are enabled
• BZ - 1122873 - Failover does not always happen from SRV to hostname resolution(via /etc/hosts)
• BZ - 1125187 - simple_allow_groups does not lookup groups from other AD domains
• BZ - 1126636 - RHEL6.6 sssd not running after upgrade
• BZ - 1127265 - Problems with tokengroups and ldap_group_search_base
• BZ - 1127270 - sssd connect to ipa-server is long
• BZ - 1127278 - Auth fails when space in username is replaced with character set by override_default_whitespace
• BZ - 1128612 - IFP: FQDN lookups are broken
• BZ - 1130017 - Saving group membership fails if provider is AD, POSIX attributes are used and primary group contains the user as a member
• BZ - 1132361 - use-after-free in dyndns code
• BZ - 1139044 - RHEL6.6 ipa user private group not found

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.6_Technical_Notes/sssd.html#RHBA-2014-1375