CVE-2016-5404

The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

USN-4792-1 — freeipa vulnerabilities

Affected: Ubuntu:Pro:14.04:LTS: freeipa, Ubuntu:Pro:16.04:LTS: freeipa

It was discovered that FreeIPA incorrectly handled certificates. An attacker could possibly use this issue to cause a denial of service by revoking arbitrary certificates This issue only affected Ubuntu 16.04 ESM. (CVE-2016-5404)

It was discovered that FreeIPA incorrectly handled authentication attempts. An attacker could possibly use this issue to cause a denial of service. (CVE-2016-7030)

It was discovered that FreeIPA incorrectly handled user's permissions. An authenticated attacker could possibly use this issue to modify other user's profiles or other unspecified impact. This issue only affected Ubuntu 16.04 ESM. (CVE-2016-9575)

Most recent entries from all

CVE-2016-5404

USN-4792-1 — freeipa vulnerabilities