CVE-2013-0220 Denial of service in n/a

What is CVE-2013-0220?

CVE-2013-0220 is a medium-severity denial of service vulnerability in n/a, published on 24 Feb 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet.

Weakness: CWE-119

Which versions are affected by CVE-2013-0220?

It affects 1 product.

Products include Fedoraproject Sssd.

How do I fix CVE-2013-0220?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2013-0220 being exploited?

There is no known exploitation of CVE-2013-0220 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-4254 Other in SSSD High 8.8
• CVE-2012-3462 Auth bypass in sssd High 8.8
• CVE-2026-104048 Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation Medium 6.8
• CVE-2015-5292 Denial of service in n/a Medium 6.8
• CVE-2026-12610 Sssd: use-after-free crash in sssd' 'sssd_pam' process Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-0220, GHSA-jj7g-h828-6wpv.