PT-2014-8295 · Red Hat · Freeipa

Published 2014-11-19 · Updated 2017-09-08 · CVE-2014-7828

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.0.x through 4.0.4 FreeIPA versions 4.1.x through 4.1.0

Description The issue allows remote attackers to bypass the password requirement of the two-factor authentication when 2FA is enabled, leveraging an enabled OTP token, which triggers an anonymous bind.

Recommendations For FreeIPA versions 4.0.x through 4.0.4, update to version 4.0.5 or later. For FreeIPA versions 4.1.x through 4.1.0, update to version 4.1.1 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-7828

Affected Products

Freeipa

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2014-7828 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-7828 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7828 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-7828 · Vendor Advisory
• http://freeipa.org/page/Releases/4.1.1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-November/143000.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1160871 · Note
• https://redhat.com/archives/freeipa-users/2014-November/msg00077.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98500 · Note
• https://redhat.com/archives/freeipa-devel/2014-November/msg00068.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7828 · Note
• http://securityfocus.com/bid/70932 · Note
• https://fedorahosted.org/freeipa/ticket/4690 · Note