PT-2008-4688 · Red Hat · Red Hat Enterprise Ipa+1

Published 2008-09-12 · Updated 2023-02-13 · CVE-2008-3274

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise IPA version 1.0.0 FreeIPA versions prior to 1.1.1

Description: The default configuration of the affected software places ldap:///anyone on the read ACL for the krbMKey attribute. This allows remote attackers to obtain the Kerberos master key via an anonymous LDAP query.

Recommendations: For Red Hat Enterprise IPA version 1.0.0, update the configuration to restrict access to the krbMKey attribute. For FreeIPA versions prior to 1.1.1, update to version 1.1.1 or later to fix the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-3274

RHSA-2008:0860

Affected Products

Freeipa

Red Hat Enterprise Ipa

References · 12

• http://freeipa.org/page/CVE-2008-3274 · Patch
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00743.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3274 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00733.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2008-0860.html · Vendor Advisory
• http://freeipa.org/page/Downloads · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=457835 · Note
• http://freeipa.org/page/News · Note
• http://securitytracker.com/id?1020850 · Note
• http://secunia.com/advisories/31861 · Note
• http://git.fedorahosted.org/git/freeipa.git/?p=freeipa.git%3Ba=commit%3Bh=9932887f2af38b9701efec27707648c026ec445c · Note
• http://securityfocus.com/bid/31111 · Note