oss-security - freeIPA CVEs CVE-2016-9575 (insufficient permission check) & CVE-2016-7030 (DoS)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAKG8Do7hHuzE3=LZv59pv50F5r_1auxPtq+6e0+LbO9tMH_V=w@mail.gmail.com>
Date: Mon, 2 Jan 2017 17:43:13 +0100
From: Cedric Buissart <cbuissar@...hat.com>
To: oss-security@...ts.openwall.com
Subject: freeIPA CVEs CVE-2016-9575 (insufficient permission check) &
 CVE-2016-7030 (DoS)

Hi,

This is to disclose the following 2 freeIPA CVEs.

1) CVE-2016-9575: Insufficient permission check in certprofile-mod

Due to a missing permission check, certprofile-mod can be used by an
authenticated but unprivileged user to modify certificate profile
configuration. This could allow the issuance of certificates with
fraudulent
subject naming information (allowing the holder of the private key to
impersonate another entity), or inappropriate key usage or extended key
usage
information (use of certificate for unauthorised purposes e.g. code
signing).

Upstream patch :
https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=fec4c32ff15

Note: on older freeipa versions (4.3 & 4.2), path to affected file differs

Impact: moderate
CVSS3 scoring : 6.3 - AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Reported by: Liam Campbell (Red Hat)
Affected versions: all versions supporting certificate profiles are
affected:
4.2 and above.

2) CVE-2016-7030 : DoS attack against kerberized services by abusing
password
policy

FreeIPA contains MIT KDC as its main component + FreeIPA is using custom
database driver for the KDC. As a side-effect of implementation, FreeIPA is
enforcing password policies for all principals, including services which do
not use "password" but keytab with randomly-generated/strong key.

Default password policy locks an account after 5 unsuccessful
authentication
attempts for 10 minutes. An attacker can use this to simply lock-out any
principal, including system services.

Upstream patch :
https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=6f1d92746

Additional dependency :
https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=73f33569c

Impact: moderate
CVSS3 scoring : 7.5 - AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected versions: all

Reported by: Petr Spacek (Red Hat)

Best Regards,

-- 
Cedric Buissart,
Product Security

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.