Bug 1258700 (CVE-2015-5246)

Summary: CVE-2015-5246 Foreman: previous password still allowed to log into foreman with Active Directory backend
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, aortega, apevec, ayoung, bkearney, chrisw, cpelland, dallan, gkotton, jrusnack, jschluet, katello-bugs, lhh, lpeer, markmc, mburns, mmccune, ohadlevy, rbryant, rhos-maint, sclewis, tdecacqu, tjay, tlestach, yeylon
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-09-01 05:24:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1258701    

Description Kurt Seifried 2015-09-01 03:56:16 UTC
larry campbell reports via the foreman bug tracker:

This was found on Foreman 1.9.0:

I came across this issue by chance. I was forced to change my Active Directory password today. After doing so, I then (mistakenly) attempted to log onto Foreman with my previous password and was able to successfully log in. The new password also worked. I tried with other browsers and even another workstation that I had never logged onto and all attempts allowed me to log on with my non-valid previous password. Perhaps something on foreman/passenger/ruby/etc is caching my credential and not re-checking?

Initial Setup:
Have an Active Directory enviornment available for LDAP Authentication. Setup LDAP Authentication Source in Foreman and have a test user account created in Active Directory.

Steps to recreate:
1. Log on to Foreman with the Active Directory user. This should succeed. Log off.
2. Change your Active Directory account's password.
3. Log on to Foreman with the Active Directory user, and use the previous password. This should fail with authentication denied method, however it succeeds.

Upstream references:
http://projects.theforeman.org/issues/11471

Comment 1 Ján Rusnačko 2015-09-01 05:14:50 UTC
If I remember correctly I ran into this back in the past - this is a feature in Active Directory. It remembers the old password for some time to allow you to log back in should you mess up your new password. I think there`s some timeout, maybe 5 minutes? after which the old password won`t be usable. 

If Foreman delegates authentication to Active Directory, this is how it`ll look like. However, since authentication is delegated to Active Directory this cannot be a vulnerability in Foreman.

Comment 3 Doran Moppert 2020-02-11 00:29:16 UTC
Statement:

Red Hat Product Security determined that this flaw was not a security vulnerability. See the Bugzilla link for more details.