CVE-2015-2704 Other in n/a
Remote attackers can inject arbitrary configurations into system files via crafted LDAP responses, potentially leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-2704?
CVE-2015-2704 is a medium-severity vulnerability in n/a, published on 18 May 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.
Weakness: CWE-74
Which versions are affected by CVE-2015-2704?
It affects 1 product.
Linux distribution packages (12)
realmd Red Hat:enterprise_linux:7::client | All versions | 0:0.16.1-5.el7 |
realmd-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:0.16.1-5.el7 |
realmd-devel-docs Red Hat:enterprise_linux:7::client | All versions | 0:0.16.1-5.el7 |
realmd Red Hat:enterprise_linux:7::computenode | All versions | 0:0.16.1-5.el7 |
realmd-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:0.16.1-5.el7 |
realmd-devel-docs Red Hat:enterprise_linux:7::computenode | All versions | 0:0.16.1-5.el7 |
realmd Red Hat:enterprise_linux:7::server | All versions | 0:0.16.1-5.el7 |
realmd-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:0.16.1-5.el7 |
realmd-devel-docs Red Hat:enterprise_linux:7::server | All versions | 0:0.16.1-5.el7 |
realmd Red Hat:enterprise_linux:7::workstation | All versions | 0:0.16.1-5.el7 |
realmd-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:0.16.1-5.el7 |
realmd-devel-docs Red Hat:enterprise_linux:7::workstation | All versions | 0:0.16.1-5.el7 |
Products include Realmd Project Realmd.
How do I fix CVE-2015-2704?
Apply the vendor's patch.
Is CVE-2015-2704 being exploited?
There is no known exploitation of CVE-2015-2704 in the wild and no public exploit code.
Sources
Also known as AZL-36985, AZL-7338, DEBIAN-CVE-2015-2704, GHSA-5vx5-x2xx-23pj, RHSA-2015:2184, UBUNTU-CVE-2015-2704.