CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5414
https://notcve.org/view.php?id=CVE-2016-5414
FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. FreeIPA 4.4.0 permite a atacantes remotos solicitar un nombre SAN arbitrario para los servicios. • https://bugzilla.redhat.com/attachment.cgi?id=1184610 https://bugzilla.redhat.com/show_bug.cgi?id=1360757 • CWE-284: Improper Access Control •
CVSS: 8.1EPSS: 0%CPEs: 10EXPL: 0CVE-2017-2590 – ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands
https://notcve.org/view.php?id=CVE-2017-2590
A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys. Se ha encontrado una vulnerabilidad en ipa en versiones anteriores a la 4.4. Los comandos ca-del, ca-disable, y ca-enable de IdM no comprobaban correctamente los permisos del usuario mientras modificaban las CA en Dogtag. • http://rhn.redhat.com/errata/RHSA-2017-0388.html http://www.securityfocus.com/bid/96557 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2590 https://access.redhat.com/security/cve/CVE-2017-2590 https://bugzilla.redhat.com/show_bug.cgi?id=1413137 • CWE-275: Permission Issues CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-7030 – ipa: DoS attack against kerberized services by abusing password policy
https://notcve.org/view.php?id=CVE-2016-7030
FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on. FreelPA utiliza una política de contraseñas por defecto que bloquea una cuenta después de 5 intentos de autenticación fallidos, lo que permite a los atacantes remotos que provoquen una denegación de servicio al bloquear la cuenta en la que se están ejecutando los servicios del sistema. It was discovered that the default IdM password policies that lock out accounts after a certain number of failed login attempts were also applied to host and service accounts. A remote unauthenticated user could use this flaw to cause a denial of service attack against kerberized services. • http://rhn.redhat.com/errata/RHSA-2017-0001.html http://www.openwall.com/lists/oss-security/2017/01/02/5 http://www.securityfocus.com/bid/94934 https://bugzilla.redhat.com/show_bug.cgi?id=1370493 https://pagure.io/freeipa?id=6f1d927467e7907fd1991f88388d96c67c9bff61 https://access.redhat.com/security/cve/CVE-2016-7030 • CWE-255: Credentials Management Errors •
CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0CVE-2016-9575 – ipa: Insufficient permission check in certprofile-mod
https://notcve.org/view.php?id=CVE-2016-9575
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks. Ipa en versiones 4.2.x, 4.3.x anteriores a la 4.3.3 y 4.4.x anteriores a la 4.4.3 no comprobaba correctamente los permisos de usuario cuando se modificaban los perfiles de certificados en el comando certprofile-mod de IdM. Un atacante autenticado sin privilegios podría utilizar este fallo para modificar perfiles y enviar certificados con nombres arbitrarios o información de uso de claves y, como consecuencia, utilizar dichos certificados para otros ataques. It was found that IdM's certprofile-mod command did not properly check the user's permissions while modifying certificate profiles. • http://rhn.redhat.com/errata/RHSA-2017-0001.html http://www.securityfocus.com/bid/95068 https://bugzilla.redhat.com/show_bug.cgi?id=1395311 https://access.redhat.com/security/cve/CVE-2016-9575 • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2016-5404 – ipa: Insufficient privileges check in certificate revocation
https://notcve.org/view.php?id=CVE-2016-5404
The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission. El comando cert_revoke en FreeIPA no realiza comprobaciones para el permiso "certificado de revocación", lo que permite a usuarios remotos autenticados revocar certificados arbitrarios aprovechando el permiso "certificado de recuperación". An insufficient permission check issue was found in the way IPA server treats certificate revocation requests. An attacker logged in with the 'retrieve certificate' permission enabled could use this flaw to revoke certificates, possibly triggering a denial of service attack. • http://rhn.redhat.com/errata/RHSA-2016-1797.html http://www.openwall.com/lists/oss-security/2016/08/17/9 http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html http://www.securityfocus.com/bid/92525 https://fedorahosted.org/freeipa/ticket/6232 https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=cf74584d0f772f3f5eccc1d30c001e4212a104fd https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PZ2ZQTMGC2UBRNHXVVOY3PJDOBP4CP4 https://lists.fedorap • CWE-284: Improper Access Control CWE-285: Improper Authorization •