The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4792-1 advisory.

  - The cert_revoke command in FreeIPA does not check for the revoke certificate permission, which allows     remote authenticated users to revoke arbitrary certificates by leveraging the retrieve certificate     permission. (CVE-2016-5404)

  - FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts,     which allows remote attackers to cause a denial of service by locking out the account in which system     services run on. (CVE-2016-7030)

  - Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's     permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated,     unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming     or key usage information and subsequently use such certificates for other attacks. (CVE-2016-9575)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the ipa packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The cert_revoke command in FreeIPA does not check for     the 'revoke certificate' permission, which allows     remote authenticated users to revoke arbitrary     certificates by leveraging the 'retrieve certificate'     permission.(CVE-2016-5404)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-5404

Along with second revision of 4.3.2 update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - An insufficient permission check issue was found in the     way IPA server treats certificate revocation requests.
    An attacker logged in with the 'retrieve certificate'     permission enabled could use this flaw to revoke     certificates, possibly triggering a denial of service     attack. (CVE-2016-5404)

This issue was discovered by Fraser Tweedale (Red Hat).

For SL7.0 and SL7.1 only, this includes updated packages for sssd, mod_auth_gssapi, and slapi-nis to satisfy dependencies.

An update for ipa is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es) :

* An insufficient permission check issue was found in the way IPA server treats certificate revocation requests. An attacker logged in with the 'retrieve certificate' permission enabled could use this flaw to revoke certificates, possibly triggering a denial of service attack. (CVE-2016-5404)

This issue was discovered by Fraser Tweedale (Red Hat).

From Red Hat Security Advisory 2016:1797 :

An update for ipa is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es) :

* An insufficient permission check issue was found in the way IPA server treats certificate revocation requests. An attacker logged in with the 'retrieve certificate' permission enabled could use this flaw to revoke certificates, possibly triggering a denial of service attack. (CVE-2016-5404)

This issue was discovered by Fraser Tweedale (Red Hat).

Security fix for CVE-2016-5404

Along with second revision of 4.3.2 update.

----

Update to FreeIPA 4.3.2 http://www.freeipa.org/page/Releases/4.3.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

security fix for CVE-2016-5404

related: https://bugzilla.redhat.com/show_bug.cgi?id=1367883

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183738	Ubuntu 16.04 ESM : FreeIPA vulnerabilities (USN-4792-1)	Nessus	Ubuntu Local Security Checks	medium
99805	EulerOS 2.0 SP1 : ipa (EulerOS-SA-2016-1042)	Nessus	Huawei Local Security Checks	medium
94882	Fedora 25 : freeipa (2016-f56c765d67)	Nessus	Fedora Local Security Checks	medium
93340	Scientific Linux Security Update : ipa on SL6.x, SL7.x i386/x86_64 (20160901)	Nessus	Scientific Linux Local Security Checks	medium
93318	CentOS 6 / 7 : ipa (CESA-2016:1797)	Nessus	CentOS Local Security Checks	medium
93269	RHEL 6 / 7 : ipa (RHSA-2016:1797)	Nessus	Red Hat Local Security Checks	medium
93268	Oracle Linux 6 / 7 : ipa (ELSA-2016-1797)	Nessus	Oracle Linux Local Security Checks	medium
93206	Fedora 24 : freeipa (2016-92a3655b70)	Nessus	Fedora Local Security Checks	medium
93205	Fedora 23 : freeipa (2016-7898627d08)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2016-5404

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium