CVE-2016-9575
published 2018-03-13CVE-2016-9575: Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's…
PriorityP434medium6.3CVSS 3.0
AVNACLPRLUINSUCLILAL
EPSS
0.79%
52.0th percentile
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freeipa | < freeipa 4.4.4-1 (bookworm) | freeipa 4.4.4-1 (bookworm) |
| freeipa | freeipa | — | — |
| freeipa | freeipa | — | — |
| freeipa | freeipa | — | — |
| freeipa | freeipa | — | — |
| freeipa | freeipa | — | — |
| freeipa | freeipa | — | — |
| freeipa | freeipa | — | — |
| freeipa | freeipa | — | — |
| freeipa | freeipa | — | — |
| freeipa | freeipa | — | — |
| freeipa | freeipa | — | — |
| freeipa | freeipa | >= 0 < 4.4.4-1 | 4.4.4-1 |
| freeipa | freeipa | >= 0 < 4.4.4-1 | 4.4.4-1 |
| freeipa | freeipa | >= 0 < 4.4.4-1 | 4.4.4-1 |
| freeipa | freeipa | >= 0 < 3.3.4-0ubuntu3.1+esm1 | 3.3.4-0ubuntu3.1+esm1 |
| freeipa | freeipa | >= 0 < 4.3.1-0ubuntu1+esm1 | 4.3.1-0ubuntu1+esm1 |
| freeipa | ipa | — | — |
| freeipa | ipa | — | — |
| freeipa | ipa | — | — |
CVSS provenance
nvdv3.06.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv6.5MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x7vx-p547-m5m5: Ipa versions 4
ghsa_unreviewed·2022-05-13
CVE-2016-9575 [MEDIUM] CWE-285 GHSA-x7vx-p547-m5m5: Ipa versions 4
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
OSV
freeipa vulnerabilities
osv·2021-03-15·CVSS 6.5
CVE-2016-5404 [MEDIUM] freeipa vulnerabilities
freeipa vulnerabilities
It was discovered that FreeIPA incorrectly handled certificates. An
attacker could possibly use this issue to cause a denial of service by
revoking arbitrary certificates This issue only affected Ubuntu 16.04 ESM.
(CVE-2016-5404)
It was discovered that FreeIPA incorrectly handled authentication attempts.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2016-7030)
It was discovered that FreeIPA incorrectly handled user's permissions. An
authenticated attacker could possibly use this issue to modify other user's
profiles or other unspecified impact. This issue only affected Ubuntu 16.04
ESM. (CVE-2016-9575)
OSV
CVE-2016-9575: Ipa versions 4
osv·2018-03-13·CVSS 6.3
CVE-2016-9575 [MEDIUM] CVE-2016-9575: Ipa versions 4
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
Ubuntu
FreeIPA vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 6.5
CVE-2016-7030 [MEDIUM] FreeIPA vulnerabilities
Title: FreeIPA vulnerabilities
Summary: Several security issues were fixed in FreeIPA.
It was discovered that FreeIPA incorrectly handled certificates. An
attacker could possibly use this issue to cause a denial of service by
revoking arbitrary certificates This issue only affected Ubuntu 16.04 ESM.
(CVE-2016-5404)
It was discovered that FreeIPA incorrectly handled authentication attempts.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2016-7030)
It was discovered that FreeIPA incorrectly handled user's permissions. An
authenticated attacker could possibly use this issue to modify other user's
profiles or other unspecified impact. This issue only affected Ubuntu 16.04
ESM. (CVE-2016-9575)
Instructions: In general, a standard system update will make all th
Red Hat
ipa: Insufficient permission check in certprofile-mod
vendor_redhat·2016-12-14·CVSS 6.3
CVE-2016-9575 [MEDIUM] CWE-863 ipa: Insufficient permission check in certprofile-mod
ipa: Insufficient permission check in certprofile-mod
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
It was found that IdM's certprofile-mod command did not properly check the user's permissions while modifying certificate profiles. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
Package: ipa (Red Ha
Debian
CVE-2016-9575: freeipa - Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly c...
vendor_debian·2016·CVSS 6.3
CVE-2016-9575 [MEDIUM] CVE-2016-9575: freeipa - Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly c...
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
Scope: local
bookworm: resolved (fixed in 4.4.4-1)
forky: resolved (fixed in 4.4.4-1)
sid: resolved (fixed in 4.4.4-1)
trixie: resolved (fixed in 4.4.4-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-9575 freeipa: ipa: Insufficient permission check in certprofile-mod [fedora-all]
bugzilla·2016-12-14·CVSS 6.3
CVE-2016-9575 [MEDIUM] CVE-2016-9575 freeipa: ipa: Insufficient permission check in certprofile-mod [fedora-all]
CVE-2016-9575 freeipa: ipa: Insufficient permission check in certprofile-mod [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2016-9575 ipa: Insufficient permission check in certprofile-mod
bugzilla·2016-11-15·CVSS 6.3
CVE-2016-9575 [MEDIUM] CVE-2016-9575 ipa: Insufficient permission check in certprofile-mod
CVE-2016-9575 ipa: Insufficient permission check in certprofile-mod
Due to a missing permission check, certprofile-mod can be used by an authenticated but unprivileged user to modify certificate profile configuration. This could allow the issuance of certificates with fraudulent subject naming information (allowing the holder of the private key to impersonate another entity), or inappropriate key usage or extended key usage information (use of certificate for unauthorised purposes e.g. code signing).
Affected versions : 4.2 and above (all versions supporting certificate profiles)
Upstream patch :
https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=fec4c32ff15a96736740cf7d2f713a21af0b227e
Discussion:
Created attachment 1220871
master, ipa-4-4, ipa-4-3, ipa-4-2 patch
---
Credit f
2018-03-13
Published