The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.

CVE-2015-1827: It was discovered that the IPA extdom Directory Server plug-in did not correctly perform memory reallocation when handling user account information. A request for a list of groups for a user that belongs to a large number of groups would cause a Directory Server to crash.

CVE-2015-0283: It was discovered that the slapi-nis Directory Server plug-in did not correctly perform memory reallocation when handling user account information. A request for information about a group with many members, or a request for a user that belongs to a large number of groups, would cause a Directory Server to enter an infinite loop and consume an excessive amount of CPU time.

These issues were discovered by Sumit Bose of Red Hat.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated ipa and slapi-nis packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Identity Management is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. It integrates components of the Red Hat Directory Server, MIT Kerberos, Red Hat Certificate System, NTP, and DNS. It provides web browser and command-line interfaces. Its administration tools allow an administrator to quickly install, set up, and administer a group of domain controllers to meet the authentication and identity management requirements of large-scale Linux and UNIX deployments.

The ipa component provides centrally managed Identity, Policy, and Audit. The slapi-nis component provides NIS Server and Schema Compatibility plug-ins for Directory Server.

It was discovered that the IPA extdom Directory Server plug-in did not correctly perform memory reallocation when handling user account information. A request for a list of groups for a user that belongs to a large number of groups would cause a Directory Server to crash.
(CVE-2015-1827)

It was discovered that the slapi-nis Directory Server plug-in did not correctly perform memory reallocation when handling user account information. A request for information about a group with many members, or a request for a user that belongs to a large number of groups, would cause a Directory Server to enter an infinite loop and consume an excessive amount of CPU time. (CVE-2015-0283)

These issues were discovered by Sumit Bose of Red Hat.

This update fixes the following bugs :

* Previously, users of IdM were not properly granted the default permission to read the 'facsimiletelephonenumber' user attribute. This update adds 'facsimiletelephonenumber' to the Access Control Instruction (ACI) for user data, which makes the attribute readable to authenticated users as expected. (BZ#1198430)

* Prior to this update, when a DNS zone was saved in an LDAP database without a dot character (.) at the end, internal DNS commands and operations, such as dnsrecord-* or dnszone-*, failed. With this update, DNS commands always supply the DNS zone with a dot character at the end, which prevents the described problem. (BZ#1198431)

* After a full-server IdM restore operation, the restored server in some cases contained invalid data. In addition, if the restored server was used to reinitialize a replica, the replica then contained invalid data as well. To fix this problem, the IdM API is now created correctly during the restore operation, and *.ldif files are not skipped during the removal of RUV data. As a result, the restored server and its replica no longer contain invalid data. (BZ#1199060)

* Previously, a deadlock in some cases occurred during an IdM upgrade, which could cause the IdM server to become unresponsive. With this update, the Schema Compatibility plug-in has been adjusted not to parse the subtree that contains the configuration of the DNA plug-in, which prevents this deadlock from triggering. (BZ#1199128)

* When using the extdom plug-in of IdM to handle large groups, user lookups and group lookups previously failed due to insufficient buffer size. With this update, the getgrgid_r() call gradually increases the buffer length if needed, and the described failure of extdom thus no longer occurs. (BZ#1203204)

Users of ipa and slapi-nis are advised to upgrade to these updated packages, which correct these issues.

The ipa component provides centrally managed Identity, Policy, and Audit. The slapi-nis component provides NIS Server and Schema Compatibility plug- ins for Directory Server.

It was discovered that the IPA extdom Directory Server plug-in did not correctly perform memory reallocation when handling user account information. A request for a list of groups for a user that belongs to a large number of groups would cause a Directory Server to crash.
(CVE-2015-1827)

It was discovered that the slapi-nis Directory Server plug-in did not correctly perform memory reallocation when handling user account information. A request for information about a group with many members, or a request for a user that belongs to a large number of groups, would cause a Directory Server to enter an infinite loop and consume an excessive amount of CPU time. (CVE-2015-0283)

This update fixes the following bugs :

  - Previously, users of IdM were not properly granted the     default permission to read the     'facsimiletelephonenumber' user attribute. This update     adds 'facsimiletelephonenumber' to the Access Control     Instruction (ACI) for user data, which makes the     attribute readable to authenticated users as expected.

  - Prior to this update, when a DNS zone was saved in an     LDAP database without a dot character (.) at the end,     internal DNS commands and operations, such as     dnsrecord-* or dnszone-*, failed. With this update, DNS     commands always supply the DNS zone with a dot character     at the end, which prevents the described problem.

  - After a full-server IdM restore operation, the restored     server in some cases contained invalid data. In     addition, if the restored server was used to     reinitialize a replica, the replica then contained     invalid data as well. To fix this problem, the IdM API     is now created correctly during the restore operation,     and *.ldif files are not skipped during the removal of     RUV data. As a result, the restored server and its     replica no longer contain invalid data.

  - Previously, a deadlock in some cases occurred during an     IdM upgrade, which could cause the IdM server to become     unresponsive. With this update, the Schema Compatibility     plug-in has been adjusted not to parse the subtree that     contains the configuration of the DNA plug-in, which     prevents this deadlock from triggering.

  - When using the extdom plug-in of IdM to handle large     groups, user lookups and group lookups previously failed     due to insufficient buffer size. With this update, the     getgrgid_r() call gradually increases the buffer length     if needed, and the described failure of extdom thus no     longer occurs.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0728 advisory.

    - CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()       (#1202997)
    - Fix CVE-2015-0283

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
82612	Fedora 21 : freeipa-4.1.4-1.fc21 / slapi-nis-0.54.2-1.fc21 (2015-4747)	Nessus	Fedora Local Security Checks	high
82554	Fedora 22 : freeipa-4.1.4-1.fc22 / slapi-nis-0.54.2-1.fc22 (2015-4788)	Nessus	Fedora Local Security Checks	high
82475	CentOS 7 : ipa / slapi-nis (CESA-2015:0728)	Nessus	CentOS Local Security Checks	high
82293	Scientific Linux Security Update : ipa and slapi-nis on SL7.x x86_64 (20150326)	Nessus	Scientific Linux Local Security Checks	high
82291	RHEL 7 : ipa and slapi-nis (RHSA-2015:0728)	Nessus	Red Hat Local Security Checks	high
82288	Oracle Linux 7 : ipa / and / slapi-nis (ELSA-2015-0728)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2015-1827

high

Tenable Plugins

high

high

high

high

high

high