Bug 1413137 (CVE-2017-2590) - CVE-2017-2590 ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands
Summary: CVE-2017-2590 ipa: Insufficient permission check for ca-del, ca-disable and c...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-2590
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1414653 1414703 1427094
Blocks: 1413140
TreeView+ depends on / blocked
 
Reported: 2017-01-13 17:37 UTC by Andrej Nemec
Modified: 2021-02-17 02:47 UTC (History)
8 users (show)

Fixed In Version: ipa 4.4
Doc Type: If docs needed, set a value
Doc Text:
It was found that IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
Clone Of:
Environment:
Last Closed: 2017-03-09 18:47:11 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0388 0 normal SHIPPED_LIVE Moderate: ipa security and bug fix update 2017-03-02 22:06:32 UTC

Description Andrej Nemec 2017-01-13 17:37:22 UTC 
Multiple security issues were found in FreeIPA's 'ca' plugin. Any authenticated but unauthorised user can delete, disable or enable CAs in Dogtag. The impact in the deletion case is denial of service for cert issuance or OCSP signing, and deletion of secret keys. The impact for disablement is denial of service for cert issuance.
Comment 1 Andrej Nemec 2017-01-13 17:37:28 UTC 
Acknowledgments:

Name: Fraser Tweedale (Red Hat)
Comment 15 Dhiru Kholia 2017-02-27 11:02:28 UTC 
Created freeipa tracking bugs for this issue:

Affects: fedora-all [bug 1427094]
Comment 16 Jan Cholasta 2017-03-01 11:13:31 UTC 
Fixed upstream:
master:
https://pagure.io/freeipa/c/b81ac59640f0b76fa9f53cf8be441f085a7089c4?branch=master
ipa-4-4:
https://pagure.io/freeipa/c/1aa314c79648c442473f19344387bfe11ec2141b?branch=ipa-4-4
Comment 18 errata-xmlrpc 2017-03-02 17:25:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:0388 https://rhn.redhat.com/errata/RHSA-2017-0388.html
Note You need to log in before you can comment on or make changes to this bug.