PT-2013-1684 · Red Hat+1 · Red Hat Enterprise Linux 6+2

Published 2013-02-20 · Updated 2019-04-22 · CVE-2012-4546

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Linux 6 (affected versions not specified)

Description The issue is related to the default configuration for IPA servers in Red Hat Enterprise Linux 6. When a certificate is revoked from an Identity Management replica, the configuration does not properly update another Identity Management replica. This inconsistency in Certificate Revocation Lists (CRLs) might allow remote attackers to bypass intended access restrictions via a revoked certificate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-16

Related Identifiers

CESA-2013_0528

CVE-2012-4546

RHSA-2013:0528

RHSA-2013_0528

Affected Products

Centos

Red Hat

Red Hat Enterprise Linux 6

References · 15

• https://linux.oracle.com/errata/ELSA-2013-0528.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4546 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4546 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0528.html · Vendor Advisory
• https://lists.centos.org/pipermail/centos-announce/2013-March/056272.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/026812.html · Note
• https://access.redhat.com/errata/RHSA-2013:0528 · Note
• https://lists.centos.org/pipermail/centos-announce/2013-March/081515.html · Note
• https://access.redhat.com/security/cve/CVE-2012-4546 · Note
• https://lists.centos.org/pipermail/centos-announce/2013-March/031391.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/013432.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/006742.html · Note
• https://rhn.redhat.com/errata/RHSA-2013-0528.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/020122.html · Note
• https://lists.centos.org/pipermail/centos-announce/2013-March/068828.html · Note