PT-2014-9072 · Red Hat · Freeipa

Published 2014-11-19 · Updated 2014-11-19

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.0.x through 4.0.4 FreeIPA versions 4.1.x through 4.1.0

Description The issue allows remote attackers to bypass the password requirement of the two-factor authentication when 2FA is enabled, by leveraging an enabled OTP token, which triggers an anonymous bind.

Recommendations For FreeIPA versions 4.0.x through 4.0.4, update to version 4.0.5 or later. For FreeIPA versions 4.1.x through 4.1.0, update to version 4.1.1 or later.

Related Identifiers

PYSEC-2014-101

Affected Products

Freeipa

References · 9

• https://osv.dev/vulnerability/PYSEC-2014-101 · Vendor Advisory
• https://redhat.com/archives/freeipa-devel/2014-November/msg00068.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98500 · Note
• http://securityfocus.com/bid/70932 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2014-November/143000.html · Note
• https://fedorahosted.org/freeipa/ticket/4690 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1160871 · Note
• https://redhat.com/archives/freeipa-users/2014-November/msg00077.html · Note
• http://freeipa.org/page/Releases/4.1.1 · Note