PT-2014-2433 · Red Hat · Freeipa

Publicado 2014-05-29 · Atualizado 2017-08-29 · CVE-2013-0199

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeIPA versions 3.0 through 3.1.2

Description The default LDAP ACIs in FreeIPA do not restrict access to the ipaNTTrustAuthIncoming and ipaNTTrustAuthOutgoing attributes, allowing remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.

Recommendations For FreeIPA versions 3.0 through 3.1.2, update to version 3.1.2 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-0199

PYSEC-2014-100

PYSEC-2014-103

Produtos afetados

Freeipa

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/81486 · Nota
• https://osv.dev/vulnerability/PYSEC-2014-103 · Aviso do Fabricante
• http://securityfocus.com/bid/57542 · Nota
• http://freeipa.org/page/CVE-2013-0199 · Aviso do Fabricante
• http://osvdb.org/89539 · Nota
• http://freeipa.org/page/Releases/3.1.2 · Nota
• https://osv.dev/vulnerability/PYSEC-2014-100 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-0199 · Nota de Segurança