PT-2014-8295 · Red Hat · Freeipa

Publicado 2014-11-19 · Atualizado 2017-09-08 · CVE-2014-7828

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.0.x through 4.0.4 FreeIPA versions 4.1.x through 4.1.0

Description The issue allows remote attackers to bypass the password requirement of the two-factor authentication when 2FA is enabled, leveraging an enabled OTP token, which triggers an anonymous bind.

Recommendations For FreeIPA versions 4.0.x through 4.0.4, update to version 4.0.5 or later. For FreeIPA versions 4.1.x through 4.1.0, update to version 4.1.1 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-7828

Produtos afetados

Freeipa

Referências · 13

• https://bugzilla.redhat.com/show_bug.cgi?id=1160871 · Nota
• https://redhat.com/archives/freeipa-users/2014-November/msg00077.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98500 · Nota
• https://redhat.com/archives/freeipa-devel/2014-November/msg00068.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7828 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-7828 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-7828 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7828 · Aviso do Fabricante
• http://securityfocus.com/bid/70932 · Nota
• https://osv.dev/vulnerability/CVE-2014-7828 · Aviso do Fabricante
• http://freeipa.org/page/Releases/4.1.1 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2014-November/143000.html · Aviso do Fabricante
• https://fedorahosted.org/freeipa/ticket/4690 · Nota