The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-660:02 advisory.

    [Security Fix]
    - FreeIPA  cert_revoke revoke certificate       retrieve certificate       (CVE-2016-5404)     CVEJVNhttp://jvndb.jvn.jp/

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-658:03 advisory.

    IPA is an integrated solution to provide centrally managed Identity (machine,     user, virtual machines, groups, authentication credentials), Policy     (configuration settings, access control information) and Audit (events,     logs, analysis thereof).
    Security issues fixed with this release:
    CVE-2016-5404
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4792-1 advisory.

    It was discovered that FreeIPA incorrectly handled certificates. An attacker could possibly use this issue     to cause a denial of service by revoking arbitrary certificates This issue only affected Ubuntu 16.04 ESM.
    (CVE-2016-5404)

    It was discovered that FreeIPA incorrectly handled authentication attempts. An attacker could possibly use     this issue to cause a denial of service. (CVE-2016-7030)

    It was discovered that FreeIPA incorrectly handled user's permissions. An authenticated attacker could     possibly use this issue to modify other user's profiles or other unspecified impact. This issue only     affected Ubuntu 16.04 ESM. (CVE-2016-9575)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the ipa packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The cert_revoke command in FreeIPA does not check for     the 'revoke certificate' permission, which allows     remote authenticated users to revoke arbitrary     certificates by leveraging the 'retrieve certificate'     permission.(CVE-2016-5404)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-5404

Along with second revision of 4.3.2 update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - An insufficient permission check issue was found in the     way IPA server treats certificate revocation requests.
    An attacker logged in with the 'retrieve certificate'     permission enabled could use this flaw to revoke     certificates, possibly triggering a denial of service     attack. (CVE-2016-5404)

This issue was discovered by Fraser Tweedale (Red Hat).

For SL7.0 and SL7.1 only, this includes updated packages for sssd, mod_auth_gssapi, and slapi-nis to satisfy dependencies.

An update for ipa is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es) :

* An insufficient permission check issue was found in the way IPA server treats certificate revocation requests. An attacker logged in with the 'retrieve certificate' permission enabled could use this flaw to revoke certificates, possibly triggering a denial of service attack. (CVE-2016-5404)

This issue was discovered by Fraser Tweedale (Red Hat).

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1797 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * An insufficient permission check issue was found in the way IPA server treats certificate revocation     requests. An attacker logged in with the 'retrieve certificate' permission enabled could use this flaw to     revoke certificates, possibly triggering a denial of service attack. (CVE-2016-5404)

    This issue was discovered by Fraser Tweedale (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1797 advisory.

    [3.0.0-50.el6.2]
    - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in       certificate revocation
      - cert-revoke: fix permission check bypass (CVE-2016-5404)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2016-5404

Along with second revision of 4.3.2 update.

----

Update to FreeIPA 4.3.2 http://www.freeipa.org/page/Releases/4.3.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

security fix for CVE-2016-5404

related: https://bugzilla.redhat.com/show_bug.cgi?id=1367883

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
289764	MiracleLinux 4 : ipa-3.0.0-50.2.0.1.AXS4 (AXSA:2016-660:02)	Nessus	Miracle Linux Local Security Checks	medium
289109	MiracleLinux 7 : ipa-4.2.0-15.19.0.1.el7.AXS7 (AXSA:2016-658:03)	Nessus	Miracle Linux Local Security Checks	medium
183738	Ubuntu 16.04 ESM : FreeIPA vulnerabilities (USN-4792-1)	Nessus	Ubuntu Local Security Checks	medium
99805	EulerOS 2.0 SP1 : ipa (EulerOS-SA-2016-1042)	Nessus	Huawei Local Security Checks	medium
94882	Fedora 25 : freeipa (2016-f56c765d67)	Nessus	Fedora Local Security Checks	medium
93340	Scientific Linux Security Update : ipa on SL6.x, SL7.x i386/x86_64 (20160901)	Nessus	Scientific Linux Local Security Checks	medium
93318	CentOS 6 / 7 : ipa (CESA-2016:1797)	Nessus	CentOS Local Security Checks	medium
93269	RHEL 6 / 7 : ipa (RHSA-2016:1797)	Nessus	Red Hat Local Security Checks	medium
93268	Oracle Linux 6 / 7 : ipa (ELSA-2016-1797)	Nessus	Oracle Linux Local Security Checks	medium
93206	Fedora 24 : freeipa (2016-92a3655b70)	Nessus	Fedora Local Security Checks	medium
93205	Fedora 23 : freeipa (2016-7898627d08)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2016-5404

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium