PT-2014-9072 · Red Hat · Freeipa

Publicado 2014-11-19 · Atualizado 2014-11-19

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.0.x through 4.0.4 FreeIPA versions 4.1.x through 4.1.0

Description The issue allows remote attackers to bypass the password requirement of the two-factor authentication when 2FA is enabled, by leveraging an enabled OTP token, which triggers an anonymous bind.

Recommendations For FreeIPA versions 4.0.x through 4.0.4, update to version 4.0.5 or later. For FreeIPA versions 4.1.x through 4.1.0, update to version 4.1.1 or later.

Identificadores relacionados

PYSEC-2014-101

Produtos afetados

Freeipa

Referências · 9

• https://redhat.com/archives/freeipa-devel/2014-November/msg00068.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98500 · Nota
• http://securityfocus.com/bid/70932 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2014-November/143000.html · Nota
• https://fedorahosted.org/freeipa/ticket/4690 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1160871 · Nota
• https://osv.dev/vulnerability/PYSEC-2014-101 · Aviso do Fabricante
• https://redhat.com/archives/freeipa-users/2014-November/msg00077.html · Nota
• http://freeipa.org/page/Releases/4.1.1 · Nota