It was found that IdM's certprofile-mod command did not properly check the user's permissions while modifying certificate profiles. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
Due to a missing permission check, certprofile-mod can be used by an authenticated but unprivileged user to modify certificate profile configuration. This could allow the issuance of certificates with fraudulent subject naming information (allowing the holder of the private key to impersonate another entity), or inappropriate key usage or extended key usage information (use of certificate for unauthorised purposes e.g. code signing).
Affected versions : 4.2 and above (all versions supporting certificate profiles)
Upstream patch :
https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=fec4c32ff15a96736740cf7d2f713a21af0b227e
Comment on attachment 1220871[details]
master, ipa-4-4, ipa-4-3, ipa-4-2 patch
For ipa-4-3 and ipa-4-2, following change is needed:
ipaserver/plugins/certprofile.py => ipalib/plugins/certprofile.py