Date: Mon, 2 Jan 2017 17:43:13 +0100 From: Cedric Buissart <cbuissar@...hat.com> To: oss-security@...ts.openwall.com Subject: freeIPA CVEs CVE-2016-9575 (insufficient permission check) & CVE-2016-7030 (DoS) Hi, This is to disclose the following 2 freeIPA CVEs. 1) CVE-2016-9575: Insufficient permission check in certprofile-mod Due to a missing permission check, certprofile-mod can be used by an authenticated but unprivileged user to modify certificate profile configuration. This could allow the issuance of certificates with fraudulent subject naming information (allowing the holder of the private key to impersonate another entity), or inappropriate key usage or extended key usage information (use of certificate for unauthorised purposes e.g. code signing). Upstream patch : https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=fec4c32ff15 Note: on older freeipa versions (4.3 & 4.2), path to affected file differs Impact: moderate CVSS3 scoring : 6.3 - AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Reported by: Liam Campbell (Red Hat) Affected versions: all versions supporting certificate profiles are affected: 4.2 and above. 2) CVE-2016-7030 : DoS attack against kerberized services by abusing password policy FreeIPA contains MIT KDC as its main component + FreeIPA is using custom database driver for the KDC. As a side-effect of implementation, FreeIPA is enforcing password policies for all principals, including services which do not use "password" but keytab with randomly-generated/strong key. Default password policy locks an account after 5 unsuccessful authentication attempts for 10 minutes. An attacker can use this to simply lock-out any principal, including system services. Upstream patch : https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=6f1d92746 Additional dependency : https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=73f33569c Impact: moderate CVSS3 scoring : 7.5 - AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected versions: all Reported by: Petr Spacek (Red Hat) Best Regards, -- Cedric Buissart, Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ