CVE-2016-7030
ipa: DoS attack against kerberized services by abusing password policy
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on.
FreelPA utiliza una política de contraseñas por defecto que bloquea una cuenta después de 5 intentos de autenticación fallidos, lo que permite a los atacantes remotos que provoquen una denegación de servicio al bloquear la cuenta en la que se están ejecutando los servicios del sistema.
It was discovered that the default IdM password policies that lock out accounts after a certain number of failed login attempts were also applied to host and service accounts. A remote unauthenticated user could use this flaw to cause a denial of service attack against kerberized services.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-08-23 CVE Reserved
- 2017-01-02 CVE Published
- 2023-05-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-255: Credentials Management Errors
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2017/01/02/5 | Mailing List |
|
| http://www.securityfocus.com/bid/94934 | Third Party Advisory | |
| https://pagure.io/freeipa?id=6f1d927467e7907fd1991f88388d96c67c9bff61 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2017-0001.html | 2018-01-05 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1370493 | 2017-01-02 | |
| https://access.redhat.com/security/cve/CVE-2016-7030 | 2017-01-02 |