CVE-2009-2410 - CVE House
Back to Database
Status published High CVE-2009-2410

The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not...

Vulnerability Description

The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password, over an ssh connection.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-2410

Credits & Attribution

No credits recorded in the NVD database.

References

More from fedorahosted

View All →
CVE-2012-6097
File descriptor leak in cronie 1.4.8, when running in certain...
Medium 4.3
CVE-2010-4341
The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in...
Low 2.1
CVE-2010-0424
The edit_cmd function in crontab.c in (1) cronie before 1.4.4...
Low 3.3
CVE-2009-2905
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and...
Medium 4.6

Affected Vendor

fedorahosted

View all reports →

Affected Software

sssd
Vulnerable Versions:
0.4.1

Timeline

Official Publish: July 30th, 2009
Last Modified: August 7th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.