This was posted to the linux-distros last week and as per the policy I'm posting it here now. Kaushik Banerjee discovered that SSSD's "simple" access provider did not work as expected when SSSD is configured as an Active Directory client when using the new (as of version 1.9.0) Active Directory provider. During the PAM account phase, SSSD may not not know the group name of a group that the user is a member of, but only the Windows Security Identifier. Because the group name is not known, the simple_deny_groups option does not work at all, and will always permit access; if any groups are noted in simple_deny_groups, all groups are permitted access. In addition, if any groups are noted in simple_allow_groups, access is always denied to everyone. By default, the configuration will allow all users to login (both simple_deny_groups and simple_allow_groups are empty). The Active Directory provider was introduced in version 1.9.0; earlier versions of SSSD are not vulnerable to this flaw. Acknowledgements: This issue was discovered by Kaushik Banerjee of Red Hat. References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0287 -- Vincent Danen / Red Hat Security Response Team