CVE-2009-2410 - The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password, over an ssh connection

Back Back to CVE browser

HIGH

The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password, over an ssh connection

Published Jul 30, 2009

7.5

HIGH

CVSS 2.0

EPSS 1.98%

Description

The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password, over an ssh connection.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (6)

http://secunia.com/advisories/36018
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/bid/35868
vdb-entryx_refsource_BID
https://bugzilla.redhat.com/attachment.cgi?id=355424
x_refsource_CONFIRMExploit
https://bugzilla.redhat.com/show_bug.cgi?id=514057
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/52210
vdb-entryx_refsource_XF
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01236.html
vendor-advisoryx_refsource_FEDORA

Link	Providers	Tags
http://secunia.com/advisories/36018		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/bid/35868		vdb-entryx_refsource_BID
https://bugzilla.redhat.com/attachment.cgi?id=355424		x_refsource_CONFIRMExploit
https://bugzilla.redhat.com/show_bug.cgi?id=514057		x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/52210		vdb-entryx_refsource_XF
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01236.html		vendor-advisoryx_refsource_FEDORA

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner redhat

Published Jul 30, 2009

Updated Aug 7, 2024

Reserved Jul 9, 2009

Link CVE-2009-2410

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2009-2410

Red Hat

Severity n/a

Public date n/a

Links CVE-2009-2410