How to Buy
This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.
The remote Scientific Linux host is missing one or more security
This Identity Management Application is a centralized authentication,
identity management and authorization solution for both traditional
and cloud based enterprise environments. It integrates components of
the Upstream Directory Server, MIT Kerberos, the Upstream Certificate
System, NTP, and DNS. It provides web browser and command-line
interfaces. Its administration tools allow an administrator to quickly
install, set up, and administer a group of domain controllers to meet
the authentication and identity management requirements of large scale
Linux and UNIX deployments.
A Cross-Site Request Forgery (CSRF) flaw was found in this package. If
a remote attacker could trick a user, who was logged into the
management web interface, into visiting a specially crafted URL, the
attacker could perform configuration changes with the privileges of
the logged in user. (CVE-2011-3636)
Due to the changes required to fix CVE-2011-3636, client tools will
need to be updated for client systems to communicate with updated
servers. New client systems will need to have the updated ipa-client
package installed to be enrolled. Already enrolled client systems will
need to have the updated certmonger package installed to be able to
renew their system certificate. Note that system certificates are
valid for two years by default.
This update includes several bug fixes. Space precludes documenting
all of these changes in this advisory.
Users of this software should upgrade to these updated packages, which
correct these issues.
A number of additional packages were added to the security repository
so that this package could be installed on older SL systems.
See also :
Update the affected packages.
Risk factor :
Medium / CVSS Base Score : 6.8
Family: Scientific Linux Local Security Checks
Nessus Plugin ID: 61188 ()
CVE ID: CVE-2011-3636
Nessus Professional: Scan unlimited IPs, run compliance checks & moreNessus Cloud: The power of Nessus for teams – from the cloud
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.