The default configuration for IPA servers in Red Hat Enterprise Linux 6, when revoking a certificate from an Identity Management replica, does not properly update another Identity Management replica, which causes inconsistent Certificate Revocation Lists (CRLs) to be used and might allow remote attackers to bypass intended access restrictions via a revoked certificate.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0528 advisory.

    - Fix typo in patch 0048 for CVE-2012-5484 (#878220)
    - Compliant client side session cookie behavior. CVE-2012-5631.
      (#886371)
    - Use secure method to retrieve IPA CA during client enrollment.
      CVE-2012-5484 (#878220)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated ipa packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat Identity Management is a centralized authentication, identity management and authorization solution for both traditional and cloud-based enterprise environments. It integrates components of the Red Hat Directory Server, MIT Kerberos, Red Hat Certificate System, NTP, and DNS. It provides web browser and command-line interfaces. Its administration tools allow an administrator to quickly install, set up, and administer a group of domain controllers to meet the authentication and identity management requirements of large-scale Linux and UNIX deployments.

It was found that the current default configuration of IPA servers did not publish correct CRLs (Certificate Revocation Lists). The default configuration specifies that every replica is to generate its own CRL;
however, this can result in inconsistencies in the CRL contents provided to clients from different Identity Management replicas. More specifically, if a certificate is revoked on one Identity Management replica, it will not show up on another Identity Management replica.
(CVE-2012-4546)

These updated ipa packages also include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.4 Technical Notes, linked to in the References, for information on the most significant of these changes.

Users are advised to upgrade to these updated ipa packages, which fix these issues and add these enhancements.

It was found that the current default configuration of IPA servers did not publish correct CRLs (Certificate Revocation Lists). The default configuration specifies that every replica is to generate its own CRL;
however, this can result in inconsistencies in the CRL contents provided to clients from different Identity Management replicas. More specifically, if a certificate is revoked on one Identity Management replica, it will not show up on another Identity Management replica.
(CVE-2012-4546)

Update to upstream 3.1.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
68762	Oracle Linux 6 : ipa (ELSA-2013-0528)	Nessus	Oracle Linux Local Security Checks	high
65157	CentOS 6 : ipa (CESA-2013:0528)	Nessus	CentOS Local Security Checks	medium
65012	Scientific Linux Security Update : ipa on SL6.x i386/x86_64 (20130221)	Nessus	Scientific Linux Local Security Checks	medium
64773	RHEL 6 : ipa (RHSA-2013:0528)	Nessus	Red Hat Local Security Checks	medium
64419	Fedora 18 : freeipa-3.1.2-1.fc18 (2013-1445)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2012-4546

high

Tenable Plugins

high

medium

medium

medium

high